5267 matches found
CVE-2025-14478
CVE-2025-14478 (Demo Importer Plus, WordPress) : The Demo Importer Plus plugin is vulnerable to XML External Entity (XXE) injection via SVG file uploads in all versions up to 2.0.9. Exploitation requires authentication at Author level or higher, and, in affected PHP configurations (older than 8.0...
PT-2026-3354
Name of the Vulnerable Software and Affected Versions Demo Importer Plus plugin for WordPress versions up to and including 2.0.9 Description The software is susceptible to XML External Entity Injection XXE through the SVG file upload functionality. This allows authenticated attackers with...
WordPress Plugin Demo Importer Plus code issue and vulnerability
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application that can be install...
Pepr Has Overly Permissive RBAC ClusterRole in Admin Mode
Severity: LOW Target: /workspace/pepr/src/lib/assets/rbac.ts Endpoint: Kubernetes RBAC configuration Method: Deployment Response / Rationale Pepr defaults to rbacMode: "admin" because the initial experience is designed to be frictionless for new users. This mode ensures that users can deploy and...
CVE-2018-10665
ILIAS 5.3.4 has XSS through unsanitized output of PHPSELF, related to shiblogout.php and third-party demo files...
CVE-2016-10800
cPanel before 58.0.4 allows demo-mode escape via Site Templates and Boxtrapper API calls SEC-138...
CVE-2022-31782
ftbench.c in FreeType Demo Programs through 2.12.1 has a heap-based buffer overflow...
CVE-2022-0440
The Catch Themes Demo Import WordPress plugin before 2.1.1 does not validate one of the file to be imported, which could allow high privivilege admin to upload an arbitrary PHP file and gain RCE even in the case of an hardened blog ie DISALLOWUNFILTEREDHTML, DISALLOWFILEEDIT and DISALLOWFILEMODS...
CVE-2017-18440
cPanel before 64.0.21 allows demo users to execute traceroute via api2 SEC-244...
CVE-2017-18439
cPanel before 64.0.21 allows demo accounts to execute code via an ImageManagerdimensions API call SEC-243...
CVE-2017-18442
cPanel before 64.0.21 allows demo accounts to execute Cpanel::SPFUI API commands SEC-246...
CVE-2017-18433
cPanel before 64.0.21 allows code execution by webmail and demo accounts via a storefilter API call SEC-236...
CVE-2017-18468
cPanel before 62.0.17 allows demo accounts to execute code via the Htaccess::setphppreference API SEC-232...
CVE-2017-18446
cPanel before 64.0.21 allows file-read and file-write operations for demo accounts via the SourceIPCheck API SEC-250...
CVE-2017-18443
cPanel before 64.0.21 allows demo and suspended accounts to use SSH port forwarding SEC-247...
CVE-2017-18469
cPanel before 62.0.17 allows demo accounts to execute code via an NVDatafetchinc API call SEC-233...
CVE-2017-18421
cPanel before 66.0.2 allows demo accounts to create databases and users SEC-271...
CVE-2017-18438
cPanel before 64.0.21 allows demo accounts to execute code via Encoding API calls SEC-242...