CVE-2023-5414 Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read

The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the showeslogs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including...

CVE-2023-5414 Icegram Express <= 5.6.23 - Authenticated (Administrator+) Directory Traversal to Arbitrary File Read

The Icegram Express plugin for WordPress is vulnerable to Directory Traversal in versions up to, and including, 5.6.23 via the showeslogs function. This allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information including...

WordPress Plugin Icegram Express Path Traversal Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Icegram Express < 5.6.24 - Admin+ Directory Traversal

Description The plugin is not validating the paths of files contained in uploaded zip archives, allowing highly privileged users, such as admins, to write arbitrary files to any part of the file system accessible by the web server via a path traversal vector...

PT-2023-32088 · WordPress · Icegram Express

Name of the Vulnerable Software and Affected Versions: Icegram Express plugin for WordPress versions up to, and including, 5.6.23 Description: The issue allows administrator-level attackers to read the contents of arbitrary files on the server, which can contain sensitive information, including...

WordPress Icegram Plugin < 3.1.12 is vulnerable to Cross Site Scripting (XSS)

Software Icegram Type Plugin Vulnerable versions 3.1.12 Fixed in 3.1.12 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2398 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 94f0d322a79a Credits Erwan LR WPScan Required...

CVE-2023-2398

The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-2398

The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

Cross site scripting

The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-2398 Icegram Engage < 3.1.12 - Reflected XSS

The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

CVE-2023-2398 Icegram Engage < 3.1.12 - Reflected XSS

The Icegram Engage WordPress plugin before 3.1.12 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...

WordPress Plugin Icegram Engage 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-19333 · WordPress · Icegram Engage

Name of the Vulnerable Software and Affected Versions: Icegram Engage WordPress plugin versions prior to 3.1.12 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly escaped before being outputted back in an attribute. This...

Exploit for SQL Injection in Icegram Email_Subscribers_\&_Newsletters

CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newslett...

Icegram Engage < 3.1.12 - Reflected XSS

The plugin does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open a page with the code below...

Icegram Engage < 3.1.12 - Reflected XSS

The plugin does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open a page with the code below...

CVE-2023-25024

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Icegram Icegram Collect plugin = 1.3.8 versions...

CVE-2023-25024

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Icegram Icegram Collect plugin = 1.3.8 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Icegram Icegram Collect plugin = 1.3.8 versions...

CVE-2023-25024 WordPress Icegram Collect plugin <= 1.3.8 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Icegram Icegram Collect plugin = 1.3.8 versions...