380 matches found
Ocean Extra < 2.1.3 - Subscriber+ Arbitrary Post Content Disclosure
The plugin does not ensure that the template to be loaded via a shortcode is actually a template, allowing any authenticated users such as subscriber to retrieve the content of arbitrary posts, such as draft, private or even password protected ones. PoC Note: This requires the OceanWP theme to be...
CVE-2023-0405 GPT3 AI Content Writer < 1.4.38 - Subscriber+ Arbitrary Post Content Update
The GPT AI Power: Content Writer & ChatGPT & Image Generator & WooCommerce Product Writer & AI Training WordPress plugin before 1.4.38 does not perform any kind of nonce or privilege checks before letting logged-in users modify arbitrary posts...
CVE-2022-36433
The blog-post creation functionality in the Amasty Blog Pro 2.10.3 plugin for Magento 2 allows injection of JavaScript code in the shortcontent and fullcontent fields, leading to XSS attacks against admin panel users via posts/preview or posts/save...
Amasty Blog 跨站脚本漏洞
Amasty Blog is a website page extension from Amasty. magento2 is an open source PHP e-commerce system. Amasty Blog Pro 2.10.5 before the version for Magento 2 has a cross-site scripting vulnerability , the vulnerability stems from the plugin in the blog post creation function fails to shortconten...
GHSA-G8JW-8VPV-PV5Q Cross-site Scripting in Backdrop CMS
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content. The account must have admin privileges...
Cross-site Scripting in Backdrop CMS
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content. The account must have admin privileges...
Cross site scripting
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content...
CVE-2022-42096
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content...
CVE-2022-42096
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content...
CVE-2022-42096: Improper Neutralization of Input During Web Page Generation
Backdrop CMS version 1.23.0 was discovered to contain a stored cross-site scripting XSS vulnerability via Post content...
CVE-2022-42096
Backdrop CMS 1.23.0 contains a stored XSS in Post content. Exploitation requires authenticated content-creation/administrative privileges (per sources). An attacker can inject malicious JavaScript that may be executed when posts are viewed, potentially compromising administrator sessions. Remedia...
PT-2022-7075 · Unknown · Backdrop Cms
Name of the Vulnerable Software and Affected Versions: Backdrop CMS version 1.23.0 Description: The issue is related to a stored cross-site scripting XSS vulnerability in Backdrop CMS. This vulnerability can be exploited via Post content, allowing a remote attacker to conduct cross-site scripting...
GHSA-G784-Q3P3-26RM hexo-admin plugin for Node.js XSS Vulnerability
The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post...
PT-2022-19343
Name of the Vulnerable Software and Affected Versions OrangeHRM version v4.10.1 Description A stored cross-site scripting XSS issue in the addNewPost component allows attackers to execute arbitrary web scripts or HTML via a crafted POST request to the /api/v1/addNewPost endpoint, using vulnerable...
GHSA-7G59-HM8V-CWMC Apache Tomcat information disclosure vulnerability
The doRead method in Apache Tomcat 4.1.32 through 4.1.34 and 5.5.10 through 5.5.20 does not return a -1 to indicate when a certain error condition has occurred, which can cause Tomcat to send POST content from one request to a different request...
CVE-2022-1503
A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module. The manipulation of the argument post-content with an input like alert1 leads to cross site scripting. The attack may be launched remote...
Cross site scripting
A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module. The manipulation of the argument post-content with an input like alert1 leads to cross site scripting. The attack may be launched remote...
CVE-2022-1503
A vulnerability, which was classified as problematic, has been found in GetSimple CMS. Affected by this issue is the file /admin/edit.php of the Content Module. The manipulation of the argument post-content with an input like alert1 leads to cross site scripting. The attack may be launched remote...