CVE-2023-2334

The edd-google-sheet-connector-pro WordPress plugin before 1.4, Easy Digital Downloads Google Sheet Connector WordPress plugin before 1.6.6 does not have CSRF check when updating its Access Code, which could allow attackers to make logged in admin change the access code to an arbitrary one via a...

CVE-2023-7229 illi Link Party! <= 1.0 - Settings Update via CSRF

The illi Link Party! WordPress plugin through 1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2024-8286

The CVE-2024-8286 entry concerns the WordPress plugin webtoffee-gdpr-cookie-consent prior to version 2.6.1, which reportedly lacks CSRF checks in certain bulk actions. Public sources in the connected documents confirm that this could allow an attacker to cause logged-in admins to perform unintend...

Cross-site Scripting (XSS)

Overview org.graylog2:graylog2-server is a log management platform. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the plugins and API Browser. An attacker with the FILESCREATE permission can upload and execute arbitrary Javascript, leading to unauthorized action...

CVE-2025-30725

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization component: Core. The supported version that is affected is 7.1.6. Difficult to exploit vulnerability allows high privileged attacker with logon to the infrastructure where Oracle VM VirtualBox executes to compromise Oracle...

CVE-2025-31132 Raven allows Remote Code Execution due to improper validation

Raven is an open-source messaging platform. A vulnerability allowed any logged in user to execute code via an API endpoint. This vulnerability is fixed in 2.1.10...

raven 输入验证错误漏洞

raven is a simple, open source team messaging platform from Commit Open Source. An input validation error vulnerability exists in versions of Raven prior to 2.1.10 that stems from allowing any logged in user to execute code via an API endpoint...

CVE-2024-13118

The IP Based Login WordPress plugin before 2.4.1 does not have CSRF checks in some places, which could allow attackers to make logged in users delete all logs via a CSRF attack...

CVE-2025-28901

Cross-Site Request Forgery CSRF vulnerability in Naren Members page only for logged in users members-page-only-for-logged-in-users allows Stored XSS.This issue affects Members page only for logged in users: from n/a through = 1.4.2...

WordPress Members page only for logged in users plugin <= 1.4.2 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by Abdi Pranata in WordPress Plugin Members page only for logged in users versions = 1.4.2...

CVE-2025-28901

Cross-Site Request Forgery CSRF vulnerability in Naren Members page only for logged in users members-page-only-for-logged-in-users allows Stored XSS.This issue affects Members page only for logged in users: from n/a through = 1.4.2...

CVE-2025-28901

CVE-2025-28901 describes a CSRF to Stored XSS vulnerability in the WordPress plugin version 1.4.2 and earlier of the Members page (logged-in users). Exploitation context is a CSRF on the Members page that can lead to stored XSS within the application for authenticated users. The CVSS 3.1 base sco...

WordPress plugin Gtbabel 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2025-7542 · Unknown · Movable Type

Name of the Vulnerable Software and Affected Versions: Movable Type affected versions not specified Description: Movable Type contains a stored cross-site scripting vulnerability in the custom block edit page of MT Block Editor. If exploited, an arbitrary script may be executed on a logged-in...

PT-2025-7546 · Tinymce +1 · Tinymce +1

Name of the Vulnerable Software and Affected Versions: Movable Type affected versions not specified Description: Movable Type contains a stored cross-site scripting issue in the HTML edit mode of MT Block Editor. It is exploitable when TinyMCE6 is used as a rich text editor, allowing an arbitrary...

CVE-2024-35110

A reflected XSS vulnerability has been found in YzmCMS 7.1. The vulnerability exists in yzmphp/core/class/application.class.php: when logged-in users access a malicious link, their cookies can be captured by an attacker...

CVE-2022-25784

Cross-site Scripting XSS vulnerability in Web GUI of SiteManager allows logged-in user to inject scripting. This issue affects: Secomea SiteManager all versions prior to 9.7...

CVE-2022-1657

Vulnerable versions of the Jupiter = 6.10.1 and JupiterX = 2.0.6 Themes allow logged-in users, including subscriber-level users, to perform Path Traversal and Local File inclusion. In the JupiterX theme, the jupiterxcploadpaneaction AJAX action present in the...

CVE-2022-24848

DHIS2 is an information system for data capture, management, validation, analytics and visualization. A SQL injection security vulnerability affects the /api/programs/orgUnits?programs= API endpoint in DHIS2 versions prior to 2.36.10.1 and 2.37.6.1. The system is vulnerable to attack only from...

CVE-2025-24320 BIG-IP Configuration utility vulnerability

A stored cross-site scripting XSS vulnerability exists in an undisclosed page of the BIG-IP Configuration utility that allows an attacker to run JavaScript in the context of the currently logged-in user. This vulnerability is due to an incomplete fix for CVE-2024-31156...