CVE-2024-37219

CVE-2024-37219 refers to a stored XSS in Page Builder Sandwich – Front-End Page Builder for WordPress, affecting versions n/a through 5.1.0. Root cause: improper neutralization of input during web page generation. Impact stated as Stored XSS; exploitation details are not provided in the sources. ...

Cross-site Scripting

Overview org.fujion.webjars:bootstrap is a popular front-end framework for faster and easier web development. Affected versions of this package are vulnerable to Cross-site Scripting through the data-loading-text attribute in the button component. An attacker can execute arbitrary JavaScript code...

Number withdrawn

Bootstrap is an open source web front-end framework developed using HTML, CSS, and JavaScript by Bootstrap, Inc. This CVE number has been withdrawn...

GHSA-JJ68-CP4V-98QF aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions...

CVE-2024-39324

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions...

aimeos/ai-admin-graphql improper access control vulnerability allows editors to manage own services

aimeos/ai-admin-graphql is the Aimeos GraphQL API admin interface. Starting in version 2022.04.1 and prior to versions 2022.10.10, 2023.10.6, and 2024.4.2, improper access control allows a editors to manage own services via GraphQL API which isn't allowed in the JQAdm front end. Versions...

MAL-2024-2881 Malicious code in portal-frontend-public (npm)

--- -= Per source details. Do not edit below this line.=-...

WordPress Page Builder Sandwich plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Page Builder Sandwich – Front-End Page Builder versions = 5.1.0...

WordPress Page Builder Sandwich plugin <= 5.1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Page Builder Sandwich – Front-End Page Builder versions = 5.1.0...

WordPress Page Builder Sandwich <= 5.1.0 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Savphill Patchstack Alliance in WordPress Plugin Page Builder Sandwich – Front-End Page Builder versions = 5.1.0...

WordPress Page Builder Sandwich – Front-End Page Builder Plugin <= 5.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Page Builder Sandwich – Front-End Page Builder Type Plugin Vulnerable versions = 5.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-37219 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 46d1ca2c63c5 Credits savphill...

WordPress Page Builder Sandwich – Front-End Page Builder Plugin <= 5.1.0 is vulnerable to Broken Access Control

Software Page Builder Sandwich – Front-End Page Builder Type Plugin Vulnerable versions = 5.1.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2024-37218 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 85666c078a9c Credits...

CVE-2024-37161 MeterSphere front-end editor stores XSS vulnerability

MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting vulnerabilities. Version 1.10.1-lts fixes this issue...

CVE-2024-37161 MeterSphere front-end editor stores XSS vulnerability

MeterSphere is an open source continuous testing platform. Prior to version 1.10.1-lts, the system's step editor stores cross-site scripting vulnerabilities. Version 1.10.1-lts fixes this issue...

WordPress ACF Front End Editor plugin <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update vulnerability

Missing Authorization to Authenticated Subscriber+ Arbitrary Content Update vulnerability discovered by Francesco Carlucci in WordPress Plugin ACF Front End Editor versions = 2.0.2...

CVE-2024-3072

The ACF Front End Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatetexts function in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

CVE-2024-3072 ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update

The ACF Front End Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatetexts function in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

CVE-2024-3072 ACF Front End Editor <= 2.0.2 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Content Update

The ACF Front End Editor plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the updatetexts function in all versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level access and above, t...

CVE-2024-3072

CVE-2024-3072 affects the ACF Front End Editor WordPress plugin. Root cause: a missing capability check in update_texts() across all versions up to 2.0.2, enabling authenticated subscribers and above to modify arbitrary post titles, content, and ACF data. Impact is unauthorized data modification ...

WordPress plugin ACF Front End Editor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blogging sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerabilit...