CVE-2017-18611: Improper Neutralization of Input During Web Page Generation

The magic-fields plugin before 1.7.2 for WordPress has XSS via the RCCWPCreateCustomFieldPage.php custom-field-css parameter...

Joomla JS Jobs 1.2.6 Arbitrary File Delete

Exploit Title: Joomla! component comjsjobs 1.2.6 - Arbitrary File Deletion Dork: inurl:"index.php?option=comjsjobs" Date: 2019-08-16 Exploit Author: qw3rTyTy Vendor Homepage: https://www.joomsky.com/ Software Link: https://www.joomsky.com/5/download/1 Version: 1.2.6 Tested on: Debian/nginx/joomla...

HackerOne: Custom Field Attributes may be created and updated for customers with Custom Field Trial enabled

The Custom Field feature is currently only available for customers on the Enterprise product edition. A trial period can be given by enabling the custom-fields-trial feature for programs who are not on that product edition yet. However, when enabling this feature, the incorrect ordering of an ACL...

Multiple Registration - Critical - Access bypass - SA-CONTRIB-2019-048

This module enables you to use special routes for user registration with special roles and custom field sets defined for the role. The module doesn't sufficiently check which user roles can be registered under the scenario when the user tries to register the user with the administrator role. This...

WordPress Custom Field Suite Plugin < 2.5.15 XSS Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2019-11871

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

CVE-2019-11871

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

Design/Logic Flaw

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

CVE-2019-11871

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

CVE-2019-11871

The CVE-2019-11871 entry concerns the WordPress plugin Custom Field Suite, affected in versions before 2.5.15. The vulnerability is an authenticated Cross-Site Scripting (XSS) flaw exploitable by editors or admins. The available connected documents confirm the affected component and scope but do ...

CVE-2019-11871: Improper Neutralization of Input During Web Page Generation

The Custom Field Suite plugin before 2.5.15 for WordPress has XSS for editors or admins...

Custom Field Suite <= 2.5.14 - Authenticated Cross-Site Scripting (XSS)

The Custom Field Suite WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

HackerOne: IDOR in Report CSV export discloses the IDs of Custom Field Attributes of Programs

Specifying a report ID of another team when requesting a CSV export leaks the ID of the Custom Field Attribute in the CSV header. Request POST /reports/export HTTP/1.1 Host: localhost:8080 ... ----------868143055 Content-Disposition: form-data; name="reportids" 17 ----------868143055...

Advanced Custom Fields <= 5.7.7 - Authenticated Cross-Site Scripting (XSS)

According to the vendor: "This release contains a fix to a recently reported XSS vunerability sic. This report showed it was possible for a logged in author to save unfiltered HTML within a custom field value. This is something that should not be possible without the unfilteredhtml capability."...

DomainMOD cross-site scripting vulnerability (CNVD-2018-26480)

DomainMod is a PHP and MySQL based open source application for managing centrally located domain names and other Internet assets. A cross-site scripting vulnerability exists in the admin/domain-fields/ page in DomainMod 4.11.01 and earlier versions. A remote attacker can exploit this vulnerabilit...

CVE-2018-19750

DomainMOD through 4.11.01 has XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields...

CVE-2018-19750

DomainMOD up to version 4.11.01 contains a stored cross-site scripting (XSS) vulnerability in the admin/domain-fields notes field used when adding a Custom Domain Field. The issue is triggered via input in the notes field of the Add Custom Field action for Custom Domain Fields. The available docu...

PT-2018-15066

Name of the Vulnerable Software and Affected Versions DomainMOD versions prior to 4.11.02 Description The issue allows for XSS via the admin/domain-fields/ notes field in an Add Custom Field action for Custom Domain Fields. Recommendations For DomainMOD versions prior to 4.11.02, update to versio...

CVE-2016-5364

Cross-site scripting XSS vulnerability in managecustomfieldeditpage.php in MantisBT 1.2.19 and earlier allows remote attackers to inject arbitrary web script or HTML via the return parameter...

Debian DLA-512-1 : mantis security update

It was discovered that there was an XSS vulnerability in custom field management in mantis, a web-based bug tracking system. For Debian 7 'Wheezy', this issue has been fixed in mantis version 1.2.18-1+deb7u1. We recommend that you upgrade your mantis packages. NOTE: Tenable Network Security has...