29 matches found
CVE-2026-105606
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
CVE-2026-105606
The Joomla Extension - joomlaboat.com (versions prior to 3.7.8 ) is vulnerable to an unauthenticated arbitrary file upload in the Custom Tables component. An attacker can upload a polyglot file with a controlled extension to a web-accessible tmp directory via a public submission form, as the stor...
EUVD-2026-115367
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
CVE-2026-105606 Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
CVE-2026-105606: joomlaboat.com Custom Tables extension for Joomla: Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated…
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission for...
CVE-2012-20003
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
CVE-2012-20003 Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
CVE-2012-20003
The Custom Tables plugin for WordPress (versions before 3.4.6 ) is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is the lack of sanitization on the 'key' parameter within the iframe.php component. An unauthenticated attacker can craft a GET request to /wp-cont...
EUVD-2012-6611
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
CVE-2012-20003 Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
PT-2026-118672
Name of the Vulnerable Software and Affected Versions Custom Tables plugin for WordPress versions prior to 3.4.6 Description A reflected cross-site scripting issue exists that allows unauthenticated attackers to inject scripts into victims' browsers to steal cookies. This occurs via the unsanitiz...
VulnCheck KEV: CVE-2012-20003
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
CVE-2012-20003: Improper Neutralization of Input During Web Page Generation
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
WordPress Custom Tables: Cross-site Scripting Vulnerabilities
Versions of WordPress Custom Tables prior to 3.4.6 contained a cross-site scripting vulnerability. This vulnerability stemmed from the uncleaned key parameter in the iframe.php file. It could lead to reflective XSS attacks. Unauthenticated attackers could construct GET requests to execute scripts...
CVE-2026-16061
The Rest Routes WordPress plugin (versions prior to 5.5.6 ) is vulnerable to an unauthenticated SQL injection attack. The root cause is the lack of proper sanitization and validation of a value taken from the URL of a public REST route before it is used in a SQL query. This specific vulnerability...
CVE-2026-16061 Rest Routes <= 5.5.5 - Unauthenticated SQLi via custom-tables/tables/{table_name}
The Rest Routes WordPress plugin through 5.5.5 does not sanitize and validate a value taken from the URL of one of its public REST routes before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
WordPress Custom Tables 3.4.4 - Cross-Site Scripting Detection
WordPress Custom Tables 3.4.4 plugin contains a cross-site scripting vulnerability via the key parameter. !/usr/bin/env python3 -- coding: utf-8 -- """WordPress Custom Tables 3.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class ModuleScanner, Httpclient: info =...
CVE-2025-15043
The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'startmigration', 'cancelmigration', and 'revertmigration' functions in all versions up to, and including, 6.15.13. This makes it possible for authenticated attackers, with...
CVE-2025-15043
The The Events Calendar plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'startmigration', 'cancelmigration', and 'revertmigration' functions in all versions up to, and including, 6.15.13. This makes it possible for authenticated attackers, with...