Lucene search
+L

1025 matches found

Vulnrichment
Vulnrichment
•added 2024/05/08 5:31 a.m.•15 views

CVE-2024-3494

The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerizecontactform' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible...

6.4CVSS5.9AI score0.00333EPSS
SaveExploits0References2
Patchstack
Patchstack
•added 2024/05/08 2:16 a.m.•13 views

WordPress Mesmerize Companion plugin <= 1.6.148 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via mesmerizecontactform Shortcode vulnerability discovered by stealthcopter in WordPress Plugin Mesmerize Companion versions = 1.6.148...

6.4CVSS5.8AI score0.00333EPSS
SaveExploits0References1Affected Software1
Patchstack
Patchstack
•added 2024/05/08 12:00 a.m.•26 views

WordPress Mesmerize Companion Plugin <= 1.6.148 is vulnerable to Cross Site Scripting (XSS)

Software Mesmerize Companion Type Plugin Vulnerable versions = 1.6.148 Fixed in 1.6.149 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-3494 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID a79965937956 Credits stealthcopter...

6.4CVSS5.8AI score0.00333EPSS
SaveExploits0References3Affected Software1
Positive Technologies
Positive Technologies
•added 2024/05/08 12:00 a.m.•18 views

PT-2024-26260 · WordPress · Mesmerize Companion

Name of the Vulnerable Software and Affected Versions: Mesmerize Companion plugin for WordPress versions up to, and including, 1.6.148 Description: The issue is related to Stored Cross-Site Scripting via the plugin's mesmerize contact form shortcode due to insufficient input sanitization and outp...

6.4CVSS6.1AI score0.00333EPSS
SaveExploits0References5
CNNVD
CNNVD
•added 2024/05/08 12:00 a.m.•35 views

WordPress plugin Mesmerize Companion 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability...

6.4CVSS5.8AI score0.00333EPSS
SaveExploits0References3
OSV
OSV
•added 2024/05/07 9:15 p.m.•12 views

CVE-2024-0022

In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another user profile due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction...

5.5CVSS6AI score0.00105EPSS
SaveExploits0References2
NVD
NVD
•added 2024/05/07 9:15 p.m.•26 views

CVE-2024-0022

In multiple functions of CompanionDeviceManagerService.java, there is a possible launch NotificationAccessConfirmationActivity of another user profile due to improper input validation. This could lead to local information disclosure with no additional execution privileges needed. User interaction...

5.5CVSS6AI score0.00105EPSS
SaveExploits0References2
CNNVD
CNNVD
•added 2024/05/07 12:00 a.m.•12 views

Google Android 安全漏洞

Google Android is a Linux-based open source operating system from Google. Google Android has an information disclosure vulnerability that stems from improper input validation in multiple methods of the CompanionDeviceManagerService.java file, which can be exploited by an attacker to launch anothe...

5.5CVSS6.2AI score0.00105EPSS
SaveExploits0References4
WPVulnDB
WPVulnDB
•added 2024/05/07 12:00 a.m.•12 views

CPO Companion <= 1.1.0 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The CPO Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to injec...

6.5CVSS5.9AI score0.00315EPSS
SaveExploits0References1
WPVulnDB
WPVulnDB
•added 2024/05/07 12:00 a.m.•22 views

Mesmerize Companion < 1.6.149 - Authenticated (Contributor+) Stored Cross-Site Scripting via mesmerize_contact_form Shortcode

Description The Mesmerize Companion plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'mesmerizecontactform' shortcode in all versions up to, and including, 1.6.148 due to insufficient input sanitization and output escaping on user supplied attributes. This makes ...

6.4CVSS5.9AI score0.00333EPSS
SaveExploits0References1Affected Software1
Positive Technologies
Positive Technologies
•added 2024/05/07 12:00 a.m.•10 views

PT-2024-15299 · Unknown · Companiondevicemanagerservice

Name of the Vulnerable Software and Affected Versions: CompanionDeviceManagerService.java affected versions not specified Description: The issue is related to improper input validation in multiple functions of CompanionDeviceManagerService.java. This could lead to the launch of...

5.5CVSS6.3AI score0.00105EPSS
SaveExploits0References8
NVD
NVD
•added 2024/05/03 8:15 a.m.•26 views

CVE-2024-33916

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue affects CPO Companion: from n/a through 1.1.0...

6.5CVSS6.7AI score0.00315EPSS
SaveExploits0References1
Vulnrichment
Vulnrichment
•added 2024/05/03 7:18 a.m.•17 views

CVE-2024-33916 WordPress CPO Companion plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue affects CPO Companion: from n/a through 1.1.0...

6.5CVSS6.7AI score0.00315EPSS
SaveExploits0References1
CVE
CVE
•added 2024/05/03 7:18 a.m.•75 views

CVE-2024-33916

CVE-2024-33916 affects MachoThemes CPO Companion for WordPress (CPO Companion plugin) with Stored XSS via input during web page generation. Root cause: improper neutralization of input. Affected range: from n/a through 1.1.0. Publicly available details from RH and Wordfence confirm the vulnerabil...

6.5CVSS5.2AI score0.00315EPSS
SaveExploits0References1
Cvelist
Cvelist
•added 2024/05/03 7:18 a.m.•42 views

CVE-2024-33916 WordPress CPO Companion plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in MachoThemes CPO Companion allows Stored XSS.This issue affects CPO Companion: from n/a through 1.1.0...

6.5CVSS7.3AI score0.00315EPSS
SaveExploits0References1
CNNVD
CNNVD
•added 2024/05/03 12:00 a.m.•15 views

WordPress plugin CPO Companion 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A cross-site...

6.5CVSS6AI score0.00315EPSS
SaveExploits0References2
Patchstack
Patchstack
•added 2024/04/29 2:08 p.m.•13 views

WordPress CPO Companion plugin <= 1.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin CPO Companion versions = 1.1.0...

6.5CVSS6.1AI score0.00315EPSS
SaveExploits0Affected Software1
Patchstack
Patchstack
•added 2024/04/29 12:00 a.m.•18 views

WordPress CPO Companion Plugin <= 1.1.0 is vulnerable to Cross Site Scripting (XSS)

Software CPO Companion Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-33916 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 57daf6c77a1b Credits Ngô Thiên An ancorn from VNPT-VCI Required...

6.5CVSS6.6AI score0.00315EPSS
SaveExploits0References1Affected Software1
WPVulnDB
WPVulnDB
•added 2024/04/16 12:00 a.m.•16 views

Blocksy Companion < 2.0.29 - Cross-Site Request Forgery

Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation on several functions. This makes it possible for unauthenticated attackers to perform unauthorized actions via a forged request granted they can trick a site administrator into performi...

8.8CVSS6.6AI score0.00208EPSS
SaveExploits0References1Affected Software1
OSV
OSV
•added 2024/04/11 1:15 p.m.•10 views

CVE-2024-31932

Cross-Site Request Forgery CSRF vulnerability in CreativeThemes Blocksy Companion.This issue affects Blocksy Companion: from n/a through 2.0.28...

8.8CVSS5.8AI score0.00208EPSS
SaveExploits0References1
Rows per page
Query Builder