PT-2023-30303

Name of the Vulnerable Software and Affected Versions Virtualmin version 7.7 Description A Stored Cross-Site Scripting XSS issue in the Custom fields of Edit Virtual Server under System Customization allows remote attackers to inject arbitrary web script or HTML via the Batch Label field. The...

WordPress Advanced Custom Fields: Extended Plugin < 0.8.8.7 SQLi Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:acf-extended:advancedcustomfields"; ifdescription...

WordPress Advanced Custom Fields: Extended Plugin < 0.8.9.4 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:acf-extended:advancedcustomfields"; ifdescription...

CVE-2023-32116

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin = 4.0.12 versions...

CVE-2023-32116

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin = 4.0.12 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin = 4.0.12 versions...

CVE-2023-32116

CVE-2023-32116 affects the WordPress plugin “TotalPress.Org Custom post types, Custom Fields & more” (versions &lt;= 4.0.12). The root cause is an authenticated stored XSS vulnerability exploitable by users with admin+ privileges; the impact is stored script execution within the plugin’s context ...

CVE-2023-32116 WordPress Custom post types Plugin <= 4.0.12 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin = 4.0.12 versions...

WordPress Plugin Custom post types, Custom Fields & more Cross-site Scripting Vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Custom post types, Custom...

CVE-2023-32116: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin = 4.0.12 versions...

WordPress Plugin Advanced Custom Fields: Extended Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

CVE-2023-5292: Improper Neutralization of Input During Web Page Generation

The Advanced Custom Fields: Extended plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'acfeform' shortcode in versions up to, and including, 0.8.9.3 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

PT-2023-32013 · WordPress · Advanced Custom Fields: Extended

Name of the Vulnerable Software and Affected Versions: Advanced Custom Fields: Extended plugin for WordPress versions up to, and including, 0.8.9.3 Description: The issue is related to Stored Cross-Site Scripting via the 'acfe form' shortcode due to insufficient input sanitization and output...

WordPress Just Custom Fields Plugin <= 3.3.2 is vulnerable to Broken Access Control

Software Just Custom Fields Type Plugin Vulnerable versions = 3.3.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46203 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fc45a795b56e Credits Abdi Pranata Required...

CVE-2023-45147

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation...

Design/Logic Flaw

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation...

CVE-2023-45147 Arbitrary keys can be added to a topic's custom fields by any user in Discourse

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation...

CVE-2023-45147

Discourse (CVE-2023-45147) allows any user to add arbitrary keys to a topic's custom fields. Impact depends on installed plugins; with default plugins, impact is low/none. Patched in the latest Discourse: upgrade to version 3.1.1 (stable) or 3.2.0.beta2 (beta). If upgrade isn’t possible, disable ...

CVE-2023-45147 Arbitrary keys can be added to a topic's custom fields by any user in Discourse

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation...

CVE-2023-45147 Arbitrary keys can be added to a topic's custom fields by any user in Discourse

Discourse is an open source community platform. In affected versions any user can create a topic and add arbitrary custom fields to a topic. The severity of this vulnerability depends on what plugins are installed and how the plugins uses topic custom fields. For a default Discourse installation...