WordPress plugin Spectra 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Open WebUI 0.1.105 Persistent Cross Site Scripting

KL-001-2024-005: Open WebUI Stored Cross-Site Scripting Title: Open WebUI Stored Cross-Site Scripting Advisory ID: KL-001-2024-005 Publication Date: 2024.08.06 Publication URL: https://korelogic.com/Resources/Advisories/KL-001-2024-005.txt 1. Vulnerability Details Affected Vendor: Open WebUI...

CVE-2024-7552

DataGear up to 5.0.0 is affected in the Data Schema Page component, specifically the function evaluateVariableExpression in ConversionSqlParamValueMapper.java. The issue is an improper neutralization of special elements used in an expression language statement, enabling a remote, potentially high...

PT-2024-28260 · Horizon Business Services Inc. · Caterease

Name of the Vulnerable Software and Affected Versions: Horizon Business Services Inc. Caterease versions 16.0.1.1663 through 24.0.1.2405 Description: The issue allows a remote attacker to perform SQL Injection due to improper neutralization of special elements used in an SQL command...

CVE-2024-39648

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Themewinter Eventin allows Stored XSS.This issue affects Eventin: from n/a through 4.0.5...

CVE-2024-39655

LiquidPoll – Advanced Polls for Creators and Brands (WP plugin) contains an unauthenticated XSS in versions up to 3.3.77; the issue is caused by improper neutralization of input during web page generation. Publicly documented impact is cross-site scripting, affecting affected sites that run the p...

CVE-2024-41702

SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...

CVE-2024-41702 SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...

CVE-2024-41702 SiberianCMS – CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

SiberianCMS - CWE-89: Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection'...

CVE-2024-41693

Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...

CVE-2024-38430 Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2024-38430 Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Matrix - CWE-79: Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...

CVE-2024-41693 Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...

Mikafon MA7 SQL注入漏洞

Mikafon MA7 is an application from Mikafon Inc. A SQL injection vulnerability exists in Mikafon MA7 versions v3.0 through v3.1, which stems from improper neutralization using a special element resulting in SQL injection...

The vulnerability in the GLPI system’s handling of requests and incidents, related to improper neutralization of special elements used in SQL commands, allows an attacker to carry out an attack based on time, using SQL injections in the REST API user_token.

The vulnerability of the GLPI system for handling requests and incidents is related to the improper neutralization of certain special elements. Exploiting this vulnerability allows a malicious actor to scan server ports or services, and to carry out attacks based on timing, using SQL injections i...

CVE-2024-6542

Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk = 2.0.0p39, 2.1.0p47, 2.2.0p32 and 2.3.0p11 allows arbitrary livestatus command execution...

CVE-2024-37259

CVE-2024-37259 affects The Ultimate WordPress Toolkit – WP Extended (WP Extended) plugin. Public sources describe Cross-Site Scripting (XSS) in WP Extended up to version 2.4.7, with varying classifications across sources: the NVD entry cites Reflected XSS, while other connected templates discuss ...

CVE-2024-38785

CVE-2024-38785 refers to a stored XSS vulnerability in the Gutenverse plugin for WordPress (Gutenverse: from n/a through 1.9.2). The issue arises from improper neutralization of input during web page generation, enabling cross-site scripting. Public details list affected versions as Gutenverse

CVE-2024-38786

CVE-2024-38786 is a Stored XSS vulnerability in the WordPress theme CoziPress (BurgerThemes) due to improper neutralization during web page generation. Affected versions are listed as CoziPress ≤ 1.0.30. Public details in the connected documents do not provide a confirmed patch or fixed version; ...

CVE-2024-37509

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Maksekeskus AS MakeCommerce for WooCommerce allows Reflected XSS.This issue affects MakeCommerce for WooCommerce: from n/a through 3.5.1...