CVE-2022-4385 Intuitive Custom Post Order < 3.1.4 - Subscriber+ Arbitrary Menu Order Update

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

PT-2023-14375

Name of the Vulnerable Software and Affected Versions Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4 Description The issue lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user into changing the menu order via a CSRF attack...

PT-2023-14374

Name of the Vulnerable Software and Affected Versions Intuitive Custom Post Order WordPress plugin versions prior to 3.1.4 Description The issue allows any logged-in user, with roles as low as Subscriber, to update the menu order due to a lack of authorization check in the update-menu-order ajax...

CVE-2022-4386: Cross-Site Request Forgery (CSRF)

The Intuitive Custom Post Order WordPress plugin before 3.1.4 lacks CSRF protection in its update-menu-order ajax action, allowing an attacker to trick any user to change the menu order via a CSRF attack...

CVE-2022-4385: Missing Authorization

The Intuitive Custom Post Order WordPress plugin before 3.1.4 does not check for authorization in the update-menu-order ajax action, allowing any logged in user with roles as low as Subscriber to update the menu order...

WordPress Login Logout Menu Plugin <= 1.3.3 is vulnerable to Cross Site Scripting (XSS)

Software Login Logout Menu Type Plugin Vulnerable versions = 1.3.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4622 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 93394eba834d Credits Lana Codes Require...

PT-2023-14858

Name of the Vulnerable Software and Affected Versions Login Logout Menu WordPress plugin versions 1.3.3 and earlier Description The issue is related to the lack of validation and escaping of some shortcode attributes in the Login Logout Menu WordPress plugin, which could allow users with the...

WordPress Plugin: Intuitive Custom Post Order Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Plugin Login Logout Menu Cross-Site Script Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

CVE-2022-4622: Undefined Security Weakness

The Login Logout Menu WordPress plugin through 1.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

Cross-site Scripting in jspreadsheet

The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting XSS...

CVE-2022-48115

CVE-2022-48115 affects jspreadsheet CE prior to 4.6.0, with a cross-site scripting (XSS) vulnerability in the dropdown/menu code path. Root cause identified as insufficient sanitization/handling in the dropdown implementation, enabling attacker-controlled input to execute scripts in a victim’s br...

PT-2023-15577

Name of the Vulnerable Software and Affected Versions jspreadsheet versions prior to 4.6.0 Description The dropdown menu in jspreadsheet was discovered to be vulnerable to cross-site scripting XSS. Recommendations For versions prior to 4.6.0, update to version 4.6.0 or later to resolve the issue...

CVE-2022-48115: Improper Neutralization of Input During Web Page Generation

The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting XSS...

CVE-2022-48115

The dropdown menu in jspreadsheet before v4.6.0 was discovered to be vulnerable to cross-site scripting XSS...

SUSE CVE-2003-1308

CRLF injection vulnerability in fvwm-menu-directory for fvwm 2.5.x before 2.5.10 and 2.4.x before 2.4.18 allows local users to execute arbitrary commands via carriage returns in a filename...

SUSE CVE-2004-0078

Buffer overflow in the index menu code menupadstring of menu.c for Mutt 1.4.1 and earlier allows remote attackers to cause a denial of service crash and possibly execute arbitrary code via certain mail messages...

SUSE CVE-2006-1999

The multiplayer menu in OpenTTD 0.4.7 allows remote attackers to cause a denial of service via a UDP packet with an incorrect size, which causes the client to return to the main menu...

SUSE CVE-2006-5969

CRLF injection vulnerability in the evalFolderLine function in fvwm 2.5.18 and earlier allows local users to execute arbitrary commands via carriage returns in a directory name, which is not properly handled by fvwm-menu-directory, a variant of CVE-2003-1308...

SUSE CVE-2012-1966

Mozilla Firefox 4.x through 13.0 and Firefox ESR 10.x before 10.0.6 do not have the same context-menu restrictions for data: URLs as for javascript: URLs, which allows remote attackers to conduct cross-site scripting XSS attacks via a crafted URL...