CVE-2021-24902

The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16361

Name of the Vulnerable Software and Affected Versions: The Typebot | Build beautiful conversational forms WordPress plugin versions prior to 1.4.3 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of the Publish...

PT-2021-16395

Name of the Vulnerable Software and Affected Versions: Smart Floating / Sticky Buttons WordPress plugin versions prior to 2.5.5 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of certain parameters before they...

CVE-2021-24902: Improper Neutralization of Input During Web Page Generation

The Typebot | Build beautiful conversational forms WordPress plugin before 1.4.3 does not sanitise and escape the Publish ID setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24992: Improper Neutralization of Input During Web Page Generation

The Smart Floating / Sticky Buttons WordPress plugin before 2.5.5 does not sanitise and escape some parameter before outputting them in attributes and page, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-21918

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘namefilter’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery...

CVE-2021-21919

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ord’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery attack...

CVE-2021-21918

A specially-crafted HTTP request can lead to SQL injection. An attacker can make authenticated HTTP requests to trigger this vulnerability at ‘namefilter’ parameter. However, the high privilege super-administrator account needs to be used to achieve exploitation without cross-site request forgery...

CVE-2021-44235

Two methods of a utility class in SAP NetWeaver AS ABAP - versions 700, 701, 702, 710, 711, 730, 731, 740, 750, 751, 752, 753, 754, 755, 756, allow an attacker with high privileges and has direct access to SAP System, to inject code when executing with a certain transaction class builder. This...

CVE-2021-24972

The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24896: Improper Neutralization of Input During Web Page Generation

The Caldera Forms WordPress plugin before 1.9.5 does not sanitise and escape the Form Name before outputting it in attributes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16359

Name of the Vulnerable Software and Affected Versions: Caldera Forms WordPress plugin versions prior to 1.9.5 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of the Form Name before outputting it in attributes...

CVE-2021-24782: Improper Neutralization of Input During Web Page Generation

The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24972: Improper Neutralization of Input During Web Page Generation

The Pixel Cat WordPress plugin before 2.6.3 does not escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

The functionality of creating accounts within the MachineAccountQuota domain of Samba networking applications is vulnerable, allowing attackers to increase their privileges.

The vulnerability of the MachineAccountQuota function, which is used for creating accounts within a Samba network interface, relates to the ability to create accounts with elevated privileges. Exploiting this vulnerability could allow an attacker to increase their privileges remotely...

Cross site scripting

The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24718: Improper Neutralization of Input During Web Page Generation

The Contact Form, Survey & Popup Form Plugin for WordPress plugin before 1.5 does not properly sanitize some of its settings allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16221

Name of the Vulnerable Software and Affected Versions Contact Form, Survey & Popup Form Plugin for WordPress versions prior to 1.5 Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to improper sanitization of some settings, even when the unfiltered html...

CVE-2021-24714: Improper Neutralization of Input During Web Page Generation

The Import any XML or CSV File to WordPress plugin before 3.6.3 does not escape the Import's Title and Unique Identifier fields before outputting them in admin pages, which could allow high privilege users to perform Cross-Site attacks even when the unfilteredhtml capability is disallowed...

PT-2021-8386

Name of the Vulnerable Software and Affected Versions ClickBank Affiliate Ads WordPress plugin versions 1.20 and earlier Description The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not escaping its settings, even when the unfiltered html is...