25 matches found
Elementor Pro <=4.2.1 - Unauthenticated Arbitrary File Upload via Form Handler
Elementor Pro plugin for WordPress in versions =4.2.1 is vulnerable to unauthenticated arbitrary file upload in the Forms module File Upload field. The validation and processfield methods iterate over submitted file entries with different early-exit logic for UPLOADERRNOFILE entries. When an...
cve-2026-32475-elementor-pro-lab
CVE-2026-32475 — Elementor Pro 表单未认证任意文件上传 → RCE 一个A/B Docker实验环境，用于复现CVE-2026-32475 （CVSS 9.x，Patchstack；Elementor Pro 表单文件上传字段，受影响版本 ≤ 4.2.1，2026-08-19在4.2.2中修复；由 Tin Pham / TF1T报告）。未认证，无需用户交互。 仅限授权测试/教育用途。 本实验环境完全运行在127.0.0.1上的一次性 Docker容器中。请勿将PoC指向未经明确授权测试的系统。 build.sh从公共GPL镜像获取Elementor...
CVE-2026-32475
CVE-2026-32475 PoC：Elementor Pro 未认证任意文件上传导致 RCE Elementor Pro 预认证任意文件上传导致远程代码执行 CVE-2026-32475 的概念验证，这是 Elementor Pro Forms 模块中的一个严重未认证任意文件上传漏洞，最终可导致远程代码执行。该 PoC 为同一上传字段提交两个文件部分——一个空的首条目（空白文件名，触发 UPLOADERRNOFILE），随后是载荷。validation 循环通过 return 在空条目上提前退出，而 processfield 通过 continue...
CVE-2026-32475
CVE-2026-32475 — Elementor Pro ≤ 4.2.1 Carga Arbitraria de Archivos sin Autenticación → RCE PoC para CVE-2026-32475 CVSS 9.0 Crítico, CWE-434: una carga arbitraria de archivos sin autenticación en el módulo de Formularios de Elementor Pro que conduce a la ejecución remota de código. Corregido en...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Forms module. An attacker can execute arbitrary web scripts or inject HTML by submitting a crafted payload into a form with a rich text type field. Details Cross-site scripting or XSS is a code...
CVE-2022-26594
Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...
Cross-Site Scripting (XSS)
mezzanine is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization in the "View Entries" feature within the Forms module, which allows an attacker to inject malicious scripts that execute in the context of another user's session...
CVE-2025-29573
Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...
Mezzanine CMS Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...
GHSA-2544-HPCQ-6G27 Mezzanine CMS Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...
PYSEC-2025-136
Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...
PYSEC-2025-136
Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...
CVE-2025-29573
Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...
CVE-2025-29573
Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...
CVE-2025-29573
Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...
CVE-2025-29573
Cross-Site Scripting XSS vulnerability exists in Mezzanine CMS 6.0.0 in the "View Entries" feature within the Forms module...
PT-2025-19774 · Unknown · Mezzanine Cms
Name of the Vulnerable Software and Affected Versions: Mezzanine CMS version 6.0.0 Description: A Cross-Site Scripting XSS issue exists in the "View Entries" feature within the Forms module. This allows for potential malicious script execution. Recommendations: For Mezzanine CMS version 6.0.0,...
CVE-2025-29573
Mezzanine CMS 6.0.0 exposes a Cross-Site Scripting (XSS) flaw in the Forms module’s View Entries feature. The vulnerability is tied to the EntriesForm path and can be triggered by submitting malicious filenames, enabling arbitrary JavaScript execution in an admin’s browser when affected entries a...
Rukovoditel 跨站脚本漏洞
Rukovoditel is a set of Web-based open source project management software from the Rukovoditel team. The software has project management, customer relationship management and other functions. Rukovoditel v3.2.1 version of a security vulnerability , the vulnerability stems from the Add New Form...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in Liferay Portal 7.3.5 through 7.4.0, and Liferay DXP 7.3 before service pack 3 allow remote attackers to inject arbitrary web script or HTML via a form field's help text to 1 Forms module's form builder, or 2 App Builder module's object form...