50 matches found
CVE-2025-23888 WordPress Custom Page Extensions Plugin <= 0.6 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GrandSlambert Custom Page Extensions custom-page-extensions allows Reflected XSS.This issue affects Custom Page Extensions: from n/a through = 0.6...
CVE-2025-23888
CVE-2025-23888 refers to a Reflected XSS in the WordPress plugin NotFound Custom Page Extensions. The vulnerability arises from improper neutralization of input during web page generation, enabling injection of script through a page generation flow. Affected software/versions: Custom Page Extensi...
PT-2025-5171 · Unknown · Notfound Custom Page Extensions
Name of the Vulnerable Software and Affected Versions: NotFound Custom Page Extensions versions 0.6 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Reflected XSS. This enables attackers ...
WordPress plugin Custom Page Extensions 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
CVE-2025-23888: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in GrandSlambert Custom Page Extensions custom-page-extensions allows Reflected XSS.This issue affects Custom Page Extensions: from n/a through = 0.6...
WordPress Custom Page Extensions Plugin <= 0.6 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by João Pedro S Alcântara Kinorth in WordPress Plugin Custom Page Extensions versions = 0.6...
PT-2025-2660
Name of the Vulnerable Software and Affected Versions Iocharger firmware for AC models versions prior to 25010801 Description The issue allows an attacker to obtain default credentials that are the same across all Iocharger AC model EV chargers by accessing a file after gaining access to the...
Sql injection
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7...
CVE-2023-47530: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7...
WordPress Plugin Redirect 404 Error Page to Homepage or Custom Page with Logs SQL Injection Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin Redirect 404 Error Page to...
PT-2023-30490
Name of the Vulnerable Software and Affected Versions WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs versions 1.8.7 and earlier Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This...
WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs Plugin <= 1.8.7 is vulnerable to SQL Injection
Software Redirect 404 Error Page to Homepage or Custom Page with Logs Type Plugin Vulnerable versions = 1.8.7 Fixed in 1.8.8 OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2023-47530 Patch priority Medium CVSS severity Medium 7.6 Developer Claim ownership PSID c586c5b28368 Credit...
Lanling OA 安全漏洞
Lanling OA is an OA management system from the Chinese company Lanling. A security vulnerability exists in Lanling OA Landray Office Automation OA. An attacker can exploit this vulnerability to read arbitrary files via the component /sys/ui/extend/varkind/custom.jsp...
CVE-2022-1896
The underConstruction WordPress plugin before 1.21 does not sanitise or escape the "Display a custom page using your own HTML" setting before outputting it, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiletredhtml capability is disallowed...
CVE-2021-25026
The Patreon WordPress plugin before 1.8.2 does not sanitise and escape the field "Custom Patreon Page name", which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
CVE-2021-24767: Cross-Site Request Forgery (CSRF)
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack...
WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs plugin <= 1.7.8 - Log Deletion via Cross-Site Request Forgery (CSRF) vulnerability
Log Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by apple502j in WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs plugin versions = 1.7.8. Solution Update the WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs plugin to the latest...
Cross-Site Request Forgery (CSRF) in namelessmc/nameless
✍️ Description Attacker able to delete any custom page with CSRF attack. It does not matter at all that your application run in localhost or elsewhere, just it is enough to run on a browser and another low privilege user or attackers know the IP address or hostname of your application. In CSRF...
