Essential Grid < 3.1.1 - Reflected XSS

Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore

Pimcore is an Open Source Data & Experience Management Platform. In affected versions the /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of getFilterConditi...

CVE-2023-47637 SQL Injection in Admin Grid Filter API in Pimcore

Pimcore is an Open Source Data & Experience Management Platform. In affected versions the /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for, passing input from the request, and later executes the returned SQL. One implementation of getFilterConditi...

Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()

Summary User input passed directly into an SQL statement allows non-admin backend users to execute arbitrary SQL statements. Details The /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for at...

GHSA-72HH-XF79-429P Pimcore SQL Injection in Admin Grid Filter API through Multiselect::getFilterConditionExt()

Summary User input passed directly into an SQL statement allows non-admin backend users to execute arbitrary SQL statements. Details The /admin/object/grid-proxy endpoint calls getFilterCondition on fields of classes to be filtered for at...

PT-2023-30527 · Pimcore · Pimcore

Name of the Vulnerable Software and Affected Versions: Pimcore versions prior to 11.1.1 Description: The issue allows backend users with basic permissions to execute arbitrary SQL statements by passing input directly into an SQL statement through the /admin/object/grid-proxy endpoint. This is due...

CVE-2023-47684

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ThemePunch OHG Essential Grid plugin = 3.1.0 versions...

CVE-2023-47684

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ThemePunch OHG Essential Grid plugin = 3.1.0 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ThemePunch OHG Essential Grid plugin = 3.1.0 versions...

WordPress Essential Grid Plugin <= 3.0.18 is vulnerable to Broken Access Control

Software Essential Grid Type Plugin Vulnerable versions = 3.0.18 Fixed in 3.0.19 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-47771 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID 7ac8b383b58b Credits Rafie Muhammad Patchstack...

CVE-2023-47684 WordPress Essential Grid Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in ThemePunch OHG Essential Grid plugin = 3.1.0 versions...

CVE-2023-47684

CVE-2023-47684 is an unauthenticated, reflected Cross-Site Scripting (XSS) vulnerability in the ThemePunch OHG Essential Grid plugin for WordPress, affecting versions

PT-2023-30564 · Themepunch Ohg · Essential Grid

Name of the Vulnerable Software and Affected Versions: ThemePunch OHG Essential Grid plugin versions = 3.1.0 Description: The issue is related to an Unauth. Reflected Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website,...

WordPress Plugin essential-grid Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

Sandworm Hackers Caused Another Blackout in Ukraine—During a Missile Strike

Russia's most notorious military hackers successfully sabotaged Ukraine's power grid for the third time last year. And in this case, the blackout coincided with a physical attack...

WordPress Essential Grid Plugin <= 3.1.0 is vulnerable to Cross Site Scripting (XSS)

Software Essential Grid Type Plugin Vulnerable versions = 3.1.0 Fixed in 3.1.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47684 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 0ab6025608bb Credits Rafie Muhammad Patchstack Required...

Grid Plus < 1.3.4 - Subscriber+ Local File Inclusion

Description The plugin does not properly validate and sanitize shortcode attributes, leading to a Local File Inclusion vulnerability. This flaw could enable attackers to include and execute arbitrary PHP files on the server, potentially bypassing access controls, exposing sensitive data, or...

Grid Plus < 1.3.3 - Subscriber+ Grid Layout Creation/Deletion/Update

Description The plugin does not properly implement capability checks on the 'gridplussavelayoutcallback' and 'gridplusdeletecallback' functions, leading to unauthorized creation, deletion and update of grid layout by any authenticated users, such as subscriber...

Important: Red Hat Security Advisory: Red Hat Data Grid 7.3.11 security update

An update for Red Hat Data Grid is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE links in the...

CVE-2023-5251

The Grid Plus plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'gridplussavelayoutcallback' and 'gridplusdeletecallback' functions in versions up to, and including, 1.3.2. This makes it possible for authenticated...