Cross site scripting

The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability...

CVE-2021-24529

CVE-2021-24529 affects the WordPress plugin Grid Gallery – Photo Image Grid Gallery (versions before 1.2.5). The vulnerability is an authenticated stored Cross-Site Scripting (XSS) caused by improper sanitization of the gallery title when creating image galleries via the WordPress admin dashboard...

CVE-2021-24529 Grid Gallery < 1.2.5 - Authenticated Stored Cross Site Scripting (XSS)

The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability...

Wordpress Plugin Grid Gallery 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the Wordpress...

WordPress PostX – Gutenberg Blocks for Post Grid plugin <= 2.4.9 - Missing Access Controls vulnerability

Missing Access Controls vulnerability discovered by apple502j in WordPress PostX – Gutenberg Blocks for Post Grid plugin versions = 2.4.9. Solution Update the WordPress PostX – Gutenberg Blocks for Post Grid plugin to the latest available version at least 2.4.10...

PostX Gutenberg Blocks for Post Grid < 2.4.10 - Missing Access Controls

The plugin performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultpoptions values. You can run this from a browser's javascript console:...

WordPress RAYS Grid plugin <= 1.2.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Jerome Bruandet NinTechNet in WordPress RAYS Grid plugin versions = 1.2.2. Solution Update the WordPress RAYS Grid plugin to the latest available version at least 1.2.3...

WordPress Post Grid plugin cross-site scripting vulnerability

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Post Grid plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress Po...

CVE-2021-24488

The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues...

CVE-2021-24488 Post Grid < 2.1.8 - Reflected Cross-Site Scripting (XSS)

The slider import search feature and tab parameter of the Post Grid WordPress plugin before 2.1.8 settings are not properly sanitised before being output back in the pages, leading to Reflected Cross-Site Scripting issues...

CVE-2021-24488

The WordPress Post Grid plugin (pre-2.1.8) contains a reflected XSS, due to improper sanitization of the slider-import search feature and the tab parameter, which are echoed back in pages. Impact: attacker could inject scripts viewed by users. Mitigation: upgrade to version 2.1.8 or higher; apply...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platform developed by Wordpress Foundation using PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Post Grid plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress Po...

Smart car chargers. Plug-n-play for hackers?

Over the last 18 months, we’ve been investigating the security of smart electric vehicle chargers. These allow the owner to remotely monitor and manage the charge state, speed and timing of their car charger, among many functions. We bought 6 different brands of chargers and also reviewed securit...

Oracle Coherence has an unspecified vulnerability (CNVD-2021-54688)

Oracle Coherence is a JCache-compliant in-memory distributed data grid solution for clustered applications and application servers.Oracle Coherence versions 3.7.1.0, 12.1.3.0.0, 12.2.1.3.0, 12.2.1.4.0, 14.1.1.0.0 An unspecified vulnerability exists in the Core component. An attacker could exploit...

Grid Gallery < 1.2.5 - Authenticated Stored Cross Site Scripting (XSS)

The plugin does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability. PoC Step 1: Install Grid Gallery - Photo Image Grid Gallery plugin in word press and activate the plugin. St...

WordPress Grid Gallery plugin <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Amal E Thamban in WordPress Grid Gallery plugin versions = 1.2.4. Solution Update the WordPress Grid Gallery plugin to the latest available version at least 1.2.5...

Grid Gallery < 1.2.5 - Authenticated Stored Cross Site Scripting (XSS)

The plugin does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability. Step 1: Install Grid Gallery - Photo Image Grid Gallery plugin in word press and activate the plugin. Step 2...

CVE-2021-32669

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for backend layouts are not properly encoded, the corresponding grid view is vulnerable to...

Cross site scripting

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for backend layouts are not properly encoded, the corresponding grid view is vulnerable to...

CVE-2021-32669 Cross-Site Scripting in Backend Grid View

TYPO3 is an open source PHP based web content management system. Versions 9.0.0 through 9.5.28, 10.0.0 through 10.4.17, and 11.0.0 through 11.3.0 have a cross-site scripting vulnerability. When settings for backend layouts are not properly encoded, the corresponding grid view is vulnerable to...