CommentTweets <= 0.6 - Settings Update via CSRF

Description The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks HTMLFormElement.prototype.submit.call document.forms0 ;...

WP All Export (Free < 1.4.1, Pro < 1.8.6) - Remote Code Execution via CSRF

Description The plugin does not check nonce tokens early enough in the request lifecycle, allowing attackers to make logged in users perform unwanted actions leading to remote code execution. Submit the following form as a Super Admin notice that it does not contain a nonce. Despite the error,...

PT-2023-31775 · WordPress · Forminator

Name of the Vulnerable Software and Affected Versions: Forminator WordPress plugin versions prior to 1.27.0 Description: The issue arises from improper sanitization of the redirect-url field in form submission settings. This could allow high-privilege users, such as administrators, to inject...

WordPress Plugin Forminator Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

Cross Site Scripting (XSS)

typo3/html-sanitizer is vulnerable to Cross-site Scripting XSS. The vulnerability allows an attacker to inject malicious code into a vulnerable TYPO3 website through bypassing the cross-site scripting prevention mechanisms via crafting a specially crafted URL or form submission. The malicious cod...

PT-2023-28756 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability in the backend management interface. This vulnerability allows attackers to create crafted web pages due to a lack of verification of the...

BaserCMS path traversal vulnerability (CNVD-2023-86331)

baserCMS is an enterprise-level content management system CMS from the baserCMS team. A path traversal vulnerability exists in versions of baserCMS prior to 4.8.0, which stems from a lack of validity checking of paths when processing directory requests by the form submission data management...

CVE-2023-43648 baserCMS Directory Traversal vulnerability in Form submission data management Feature

baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue...

CVE-2023-43648 baserCMS Directory Traversal vulnerability in Form submission data management Feature

baserCMS is a website development framework. Prior to version 4.8.0, there is a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. Version 4.8.0 contains a patch for this issue...

Directory Traversal

basercms is vulnerable to Directory Traversal. The vulnerability is due to improper sanitization and validation in the Form submission data management feature. An attacker can exploit this vulnerability to gain sensitive information from the server...

baserCMS Directory Traversal vulnerability in Form submission data management Feature

There is a Directory Traversal Vulnerability in Form submission data management Feature to baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible...

GHSA-HMQJ-GV2M-HQ55 baserCMS Directory Traversal vulnerability in Form submission data management Feature

There is a Directory Traversal Vulnerability in Form submission data management Feature to baserCMS. This is a vulnerability that needs to be addressed when the management system is used by an unspecified number of users. If you are eligible, please update to the new version as soon as possible...

PT-2023-28899 · Basercms · Basercms

Name of the Vulnerable Software and Affected Versions: baserCMS versions prior to 4.8.0 Description: The issue concerns a Directory Traversal Vulnerability in the form submission data management feature of baserCMS. This vulnerability could allow a logged-in user to obtain information on the...

Luxcal Event Calendar 3.2.3 Cross Site Request Forgery

==================================================================================================================================== | Title : Luxcal Event Calendar v3.2.3 CSRF Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 63.0.3 32-bit...

CVE-2023-42359

SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username parameter in /index.php...

Sql injection

SQL injection vulnerability in Exam Form Submission in PHP with Source Code v.1.0 allows a remote attacker to escalate privileges via the val-username parameter in /index.php...

CVE-2023-42359

The CVE-2023-42359 entry describes a SQL injection in the Exam Form Submission feature of PHP with Source Code v1.0. The vulnerability affects the /index.php handling of the val-username parameter, enabling a remote attacker to escalate privileges. According to the provided metrics, the flaw has ...

Open Redirect

Apache tomcat is vulnerable to Open Redirect Vulnerability. The vulnerability arises due to not validating/sanitizing the request uri used to redirect a user back to the original page after a successful form submission. The attacker can redirect a user to any malicious crafted url leading to open...

Min Max Control < 4.6 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. alert1'...

CVE-2022-4023 3DPrint < 3.5.6.9 - CSRF to arbitrary file downlad

The 3DPrint WordPress plugin before 3.5.6.9 does not protect against CSRF attacks in the modified version of Tiny File Manager included with the plugin, allowing an attacker to craft a malicious request that will create an archive of any files or directories on the target server by tricking a...