PT-2023-16509 · WordPress · Clock In Portal- Staff & Attendance Management

Name of the Vulnerable Software and Affected Versions: The Clock In Portal- Staff & Attendance Management WordPress plugin versions 2.1 and earlier Description: The issue is related to the lack of a CSRF check when deleting staff members, which could allow attackers to make logged-in admins delet...

PT-2023-16511 · WordPress · Clock In Portal- Staff & Attendance Management

Name of the Vulnerable Software and Affected Versions: The Clock In Portal- Staff & Attendance Management WordPress plugin versions 2.1 and earlier Description: The issue is related to the lack of a CSRF check when deleting holidays, which could allow attackers to make logged-in admins delete...

CVE-2023-0761: Undefined Security Weakness

The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Staff members, which could allow attackers to make logged in admins delete arbitrary Staff via a CSRF attack...

CVE-2023-0763: Cross-Site Request Forgery (CSRF)

The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack...

WordPress plugin Clock In Portal- Staff & Attendance Management 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

WordPress plugin Clock In Portal- Staff & Attendance Management 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

CVE-2023-0762: Undefined Security Weakness

The Clock In Portal- Staff & Attendance Management WordPress plugin through 2.1 does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack...

WordPress Clock In Portal- Staff & Attendance Management Plugin <= 2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Clock In Portal- Staff & Attendance Management Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-0761 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 0eaffa3213eb...

WordPress Clock In Portal- Staff & Attendance Management Plugin <= 2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Clock In Portal- Staff & Attendance Management Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-0763 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 460bee1676e1...

WordPress Clock In Portal- Staff & Attendance Management Plugin <= 2.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Clock In Portal- Staff & Attendance Management Type Plugin Vulnerable versions = 2.2 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-0762 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 3c54110da1a9...

Clock In Portal <= 2.1 - Holidays Deletion via CSRF

The plugin does not have CSRF check when deleting Holidays, which could allow attackers to make logged in admins delete arbitrary holidays via a CSRF attack PoC Make a logged in admin open a page with the code below, this will make them delete the Holiday with ID 1...

CVE-2020-15497

jcore/portal/ajaxPortal.jsp in Jalios JCMS 10.0.2 build-20200224104759 allows XSS via the types parameter. Note: It is asserted that this vulnerability is not present in the standard installation of Jalios JCMS...

CVE-2014-8304

Cross-site scripting XSS vulnerability in In-Portal CMS 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the nexttemplate parameter to admin/index.php...

Cross site scripting

Cross-site scripting XSS vulnerability in In-Portal CMS 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the nexttemplate parameter to admin/index.php...

CVE-2014-8304

Cross-site scripting XSS vulnerability in In-Portal CMS 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the nexttemplate parameter to admin/index.php...

CVE-2014-8304

CVE-2014-8304 is an XSS vulnerability in In-Portal CMS 5.2.0 and earlier. The issue allows remote attackers to inject arbitrary web script or HTML via the next_template parameter to admin/index.php. Affected component: In-Portal CMS web interface (admin panel). Root cause is input handling in nex...

PT-2014-8453

Name of the Vulnerable Software and Affected Versions In-Portal CMS versions 5.2.0 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the next template parameter to "admin/index.php". Recommendations For In-Portal CMS versions...

CVE-2014-8304: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in In-Portal CMS 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the nexttemplate parameter to admin/index.php...

XSS vulnerability in In-Portal CMS

Hello 3APA3A! After I informed developers in August about multiple vulnerabilities in In-Portal CMS and they answered they would fix them soon so wait for disclosure of the first vulnerabilities, I found new hole in this CMS at their official site. This is Cross-Site Scripting vulnerability in...

Vulnerabilities in In-Portal CMS

Hello 3APA3A! These are Cross-Site Scripting and Brute Force vulnerabilities in In-Portal CMS. ------------------------- Affected products: ------------------------- Vulnerable are In-Portal CMS 5.2.0 and previous versions. In version In-Portal CMS 5.2.1 at 31.08.2014 developers fixed XSS...