PT-2021-16225

Name of the Vulnerable Software and Affected Versions The Restaurant Menu by MotoPress WordPress plugin versions prior to 2.4.2 Description The issue concerns a lack of proper sanitization or escaping of inputs when creating new menu items, potentially allowing high-privilege users to perform...

PT-2021-16140

Name of the Vulnerable Software and Affected Versions MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin versions prior to 2.4.2 Description The issue arises from the plugin's failure to properly sanitize or escape data in some of its Playlist settings. This oversight allows...

CVE-2021-24624: Improper Neutralization of Input During Web Page Generation

The MP3 Audio Player for Music, Radio & Podcast by Sonaar WordPress plugin before 2.4.2 does not properly sanitize or escape data in some of its Playlist settings, allowing high privilege users to perform Cross-Site Scripting attacks...

CVE-2021-24773: Improper Neutralization of Input During Web Page Generation

The WordPress Download Manager WordPress plugin before 3.2.16 does not escape some of the Download settings when outputting them, allowing high privilege users to perform XSS attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24715: Improper Neutralization of Input During Web Page Generation

The WP Sitemap Page WordPress plugin before 1.7.0 does not properly sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24722: Improper Neutralization of Input During Web Page Generation

The Restaurant Menu by MotoPress WordPress plugin before 2.4.2 does not properly sanitize or escape inputs when creating new menu items, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24813: Improper Neutralization of Input During Web Page Generation

The Events Made Easy WordPress plugin before 2.2.24 does not sanitise and escape Custom Field Names, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24794: Improper Neutralization of Input During Web Page Generation

The Connections Business Directory WordPress plugin before 10.4.3 does not escape the Address settings when creating an Entry, which could allow high privilege users to perform Cross-Site Scripting when the unfilteredhtml capability is disallowed...

PT-2021-16283

Name of the Vulnerable Software and Affected Versions: Flat Preloader WordPress plugin versions prior to 1.5.5 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not escaping some of its settings when outputting them in attributes in the...

PT-2021-16306

Name of the Vulnerable Software and Affected Versions: Events Made Easy WordPress plugin versions prior to 2.2.24 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the lack of sanitization and escaping of Custom Field Names, even when the unfiltered...

PT-2021-16270

Name of the Vulnerable Software and Affected Versions: WordPress Download Manager versions prior to 3.2.16 Description: The issue allows high privilege users to perform XSS attacks even when the unfiltered html capability is disallowed, due to the plugin not escaping some of the Download settings...

CVE-2021-24793: Improper Neutralization of Input During Web Page Generation

The WPeMatico RSS Feed Fetcher WordPress plugin before 2.6.12 does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16218

Name of the Vulnerable Software and Affected Versions WP Sitemap Page WordPress plugin versions prior to 1.7.0 Description The issue arises from the plugin's failure to properly sanitise and escape some of its settings. This could allow high privilege users to perform Cross-Site Scripting attacks...

PT-2021-8380

Name of the Vulnerable Software and Affected Versions WP-Stats WordPress plugin versions prior to 2.52 Description The issue allows an attacker to make logged-in high-privilege users change settings and set Cross-Site Scripting payloads due to the lack of a CSRF check when saving settings and the...

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/J). Supported versions that are affected are 8.0.26 and prior. Difficult to exploit vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Connectors. Successful attacks of this vulnerability can result in unauthorized access to critical data or complete access to all MySQL Connectors accessible data and unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Connectors. CVSS 3.1 Base Score 5.9 (Confidentiality and Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:N/A:H).

...

CVE-2021-37131

There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this...

CVE-2021-37131

There is a CSV injection vulnerability in ManageOne, iManager NetEco and iManager NetEco 6000. An attacker with high privilege may exploit this vulnerability through some operations to inject the CSV files. Due to insufficient input validation of some parameters, the attacker can exploit this...

Vulnerability in the MySQL Server product of Oracle MySQL (component: Server: FTS). Supported versions that are affected are 8.0.26 and prior. Easily exploitable vulnerability allows high privileged attacker with network access via multiple protocols to compromise MySQL Server. Successful attacks of this vulnerability can result in unauthorized ability to cause a hang or frequently repeatable crash (complete DOS) of MySQL Server. CVSS 3.1 Base Score 4.9 (Availability impacts). CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:H).

...

CVE-2021-24785

The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24785

The Great Quotes WordPress plugin through 1.0.0 does not sanitise and escape the Quote and Author fields of its Quotes, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...