Design/Logic Flaw

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to...

Authorization

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lacking authorization protections, checks against users editing other's posts, and lacking a security nonce, all on the wpfmeditfiletitledesc AJ...

CVE-2021-4383 WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Content Injection

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to...

CVE-2021-4383

CVE-2021-4383 affects the WP Quick FrontEnd Editor plugin for WordPress. Technical details in the connected documents show a vulnerability in page-editing due to missing capability checks, making it possible for low-authenticated users (e.g., subscribers) to edit or create any page or post on sit...

CVE-2021-4383 WP Quick FrontEnd Editor <= 5.5 - Authenticated (Subscriber+) Content Injection

The WP Quick FrontEnd Editor plugin for WordPress is vulnerable to page content injection in versions up to, and including, 5.5. This is due to missing capability checks in the plugin's page-editing functionality. This makes it possible for low-authenticated attackers, such as subscribers, to...

CVE-2021-4369

The CVE-2021-4369 entry concerns the WordPress Frontend File Manager plugin. Concrete details in connected sources show that versions up to and including 18.2 are affected by Unauthenticated Content Injection due to missing authorization protections, missing checks for editing others’ posts, and ...

CVE-2021-4369 Frontend File Manager <= 18.2 - Unauthenticated Content Injection

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lacking authorization protections, checks against users editing other's posts, and lacking a security nonce, all on the wpfmeditfiletitledesc AJ...

CVE-2021-4369 Frontend File Manager <= 18.2 - Unauthenticated Content Injection

The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Content Injection in versions up to, and including, 18.2. This is due to lacking authorization protections, checks against users editing other's posts, and lacking a security nonce, all on the wpfmeditfiletitledesc AJ...

WordPress is vulnerable to Content Injection

Software WordPress Type WordPress Core Vulnerable versions = 6.2.1 Fixed in 6.2.2 OWASP Top 10 A1: Injection Classification Content Injection CVE N/A Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 75b3c88a5b55 Credits N/A Required privilege Unauthenticated Published 22 Ma...

WP < 6.2.1 - Contributor+ Content Injection

Description WordPress does not properly sanitise block attributes, which could allow users with a role of Contributor and above to perform content injection in comments on blog using a theme compatible with a block editor...

WordPress is vulnerable to Content Injection

Software WordPress Type WordPress Core Vulnerable versions = 6.2 Fixed in 6.2.1 OWASP Top 10 A1: Injection Classification Content Injection CVE N/A Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 59313c44273c Credits Liam Gladdy WPEngine Required privilege Unauthenticated...

WordPress is vulnerable to Content Injection

Software WordPress Type WordPress Core Vulnerable versions = 6.2 Fixed in 6.2.1 OWASP Top 10 A1: Injection Classification Content Injection CVE N/A Patch priority Low CVSS severity Low 6.4 Developer Claim ownership PSID a1a58401f3c0 Credits N/A Required privilege Contributor Published 17 May, 202...

rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations

A Cross-site scripting vulnerability was found in rails-html-sanitizer. Certain configurations of rails-html-sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...

rubygem-rails-html-sanitizer: Cross site scripting vulnerability with certain configurations

A Cross-site scripting vulnerability was found in rails-html-sanitizer. Certain configurations of rails-html-sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags...

Gitlab -- Multiple Vulnerabilities

Gitlab reports: Privilege escalation for external users when OIDC is enabled under certain conditions Account takeover through open redirect for Group SAML accounts Users on banned IP addresses can still commit to projects User with developer role group can modify Protected branches setting on...

CVE-2022-3695

CVE-2022-3695 affects Hitachi Vantara Pentaho Business Analytics Server prior to 9.3.0.0, 9.2.0.4, and 8.3.0.27. The vulnerability arises when the CDE plugin is present and a malicious URL can inject content into a dashboard. Impact is content injection via URL provided to dashboards; exploitatio...

PT-2023-13514 · Hitachi Vantara · Pentaho Business Analytics Server

Name of the Vulnerable Software and Affected Versions: Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.3.0.0 Hitachi Vantara Pentaho Business Analytics Server versions prior to 9.2.0.4 Hitachi Vantara Pentaho Business Analytics Server versions prior to 8.3.0.27 Description:...

CVE-2022-4771

CVE-2022-4771 affects Hitachi Vantara Pentaho Business Analytics Server. The root cause is improper neutralization of input during web page generation, enabling cross-site scripting via session variables injected through a malicious URL. Affected versions are prior to 9.4.0.1 and 9.3.0.2, includi...

K22356857: APT remote code injection vulnerability CVE-2019-3462

Security Advisory Description Incorrect sanitation of the 302 redirect field in HTTP transport method of apt versions 1.4.8 and earlier can lead to content injection by a MITM attacker, potentially leading to remote code execution on the target machine. CVE-2019-3462 Impact There is no impact; F5...

WordPress WoodMart Theme <= 7.0.4 is vulnerable to Content Injection

Software WoodMart Type Theme Vulnerable versions = 7.0.4 Fixed in 7.1.1 OWASP Top 10 A1: Injection Classification Content Injection CVE CVE-2023-25790 Patch priority Low CVSS severity Low 5.3 Developer Xtemos PSID b69ab1de1e4a Credits RE-ALTER Required privilege Unauthenticated Published 16...