10734 matches found
PT-2023-24585
Name of the Vulnerable Software and Affected Versions Liferay Portal versions 7.4.3.21 through 7.4.3.62 Liferay DXP 7.4 update 21 through 62 Description A cross-site scripting XSS issue exists in the Account module, allowing remote attackers to inject arbitrary web script or HTML via crafted...
Novelist < 1.2.1 - Admin+ Stored XSS
The plugin does not sanitize and escape some fields in the plugin settings, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup...
CVE-2022-47157
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Don Benjamin WP Custom Fields Search plugin = 1.2.34 versions...
CVE-2022-47157
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Don Benjamin WP Custom Fields Search plugin = 1.2.34 versions...
CVE-2022-47157 WordPress WP Custom Fields Search Plugin <= 1.2.34 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Don Benjamin WP Custom Fields Search plugin = 1.2.34 versions...
CVE-2022-47157
CVE-2022-47157 concerns the WordPress plugin WP Custom Fields Search (Don Benjamin) up to version 1.2.34. The vulnerability is a stored XSS caused by insufficient sanitization/escaping in plugin settings, exploitable by users with admin privileges (administrator+). Impact is stored script injecti...
WordPress Plugin WP Custom Fields Search 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerability...
more POST-after-PUT confusion
When doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously was used to issue a PUT request which used that callback. This flaw may surprise the...
UBUNTU-CVE-2023-28322
An information disclosure vulnerability exists in curl v8.1.0 when doing HTTPS transfers, libcurl might erroneously use the read callback CURLOPTREADFUNCTION to ask for data to send, even when the CURLOPTPOSTFIELDS option has been set, if the same handle previously wasused to issue a PUT request...
Advanced Custom Fields for WordPress < 5.12.6 Cross-Site Scripting
The WordPress Advanced Custom Fields Plugin installed on the remote host is affected by a Cross-Site Scripting. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...
CVE-2023-1839
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.6 does not sanitize and escape some of its setting fields, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example...
CVE-2023-1839
CVE-2023-1839 affects the WordPress plugin Product Addons & Fields for WooCommerce (PPOM) up to version 32.0.5. The issue is that the plugin does not sanitize and escape certain setting fields, enabling stored cross-site scripting by high-privilege users (e.g., admins), even when unfiltered_html ...
CVE-2023-23445
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to gain unauthorized access to data fields by using a therefore unpriviledged account via the REST interface...
Improper access control
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to gain unauthorized access to data fields by using a therefore unpriviledged account via the REST interface...
CVE-2023-23445
CVE-2023-23445 affects SICK FTMg AIR FLOW SENSOR (partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526). The root cause is Improper Access Control allowing an unprivileged remote attacker to access data fields via the REST interface. The CVE has a high impact on confidentiali...
CVE-2023-23445
Improper Access Control in SICK FTMg AIR FLOW SENSOR with Partnumbers 1100214, 1100215, 1100216, 1120114, 1120116, 1122524, 1122526 allows an unprivileged remote attacker to gain unauthorized access to data fields by using a therefore unpriviledged account via the REST interface...
XSS Vulnerability in Popular WordPress Plugin Affects 2 Million Sites
Threat Level Vulnerability Report For a detailed threat advisory, download the pdf file here Summary A Cross-Site scripting vulnerability has been discovered in an Advanced Custom Fields plugin for WordPress which has put 2 Million websites at risk. To receive real-time threat advisories, please...
WordPress plugin Product Addons & Fields for WooCommerce 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
PT-2023-17272 · WordPress · Addons & Fields For Woocommerce
Name of the Vulnerable Software and Affected Versions: Product Addons & Fields for WooCommerce WordPress plugin version 32.0.5 and earlier Description: The issue allows high-privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability i...
