CVE-2023-4108 Audit logging fails to sanitize post metadata

Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged...

CVE-2023-4108 Audit logging fails to sanitize post metadata

Mattermost fails to sanitize post metadata during audit logging resulting in permalinks contents being logged...

PT-2023-27774 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue is related to Mattermost's failure to sanitize post metadata during audit logging, resulting in the contents of permalinks being logged. Recommendations: At the moment, there i...

Change WP Admin < 1.1.4 - Secret Login Page Disclosure

Description The plugin discloses the URL of the hidden login page when accessing a crafted URL, bypassing the protection offered. - Set custom Login URL under "Settings Permalinks". For example, login - As an unauthenticated visitor, open https://example.com/wp-admin/customize.php in a different...

CVE-2023-2495

The Greeklish-permalink WordPress plugin through 3.3 does not implement correct authorization or nonce checks in the cyrtransajaxold AJAX action, allowing unauthenticated and low-privilege users to trigger the plugin's functionality to change Post slugs either directly or through CSRF...

Information Disclosure

github.com/mattermost/mattermost-server is vulnerable to Information Disclosure. The vulnerability exists because the library fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a maliciously crafted permalink on a channel...

Mattermost Code Injection Vulnerability

Mattermost is an open source collaboration platform from Mattermost, Inc. in the United States. Mattermost suffers from a code injection vulnerability that stems from an inability to clean up code permalinks, which can be exploited by an attacker to preview code by posting a specially crafted lin...

CVE-2023-2797

Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel...

CVE-2023-2797 Path traversal in GitHub plugin's code preview feature

Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel...

CVE-2023-2797 Path traversal in GitHub plugin's code preview feature

Mattermost fails to sanitize code permalinks, allowing an attacker to preview code from private repositories by posting a specially crafted permalink on a channel...

PT-2023-21463 · Unknown · Mattermost

Name of the Vulnerable Software and Affected Versions: Mattermost affected versions not specified Description: The issue allows an attacker to preview code from private repositories by posting a specially crafted permalink on a channel, due to the failure to sanitize code permalinks...

CVE-2023-33361

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php...

Sql injection

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php...

CVE-2023-33361

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php...

PT-2023-24309 · Piwigo · Piwigo

Name of the Vulnerable Software and Affected Versions: Piwigo version 13.6.0 Description: The issue is related to SQL Injection via the "/admin/permalinks.php" API endpoint. This allows for potential exploitation. No information is provided about the estimated number of potentially affected devic...

CVE-2023-33361

Piwigo 13.6.0 is vulnerable to SQL Injection via /admin/permalinks.php...

Piwigo SQL注入漏洞

Piwigo is a Web-based open source photo gallery software. The software includes features such as image management, image categorization and permission management. A security vulnerability exists in Piwigo version 13.6.0, which stems from a problem in the /admin/permalinks.php file and can be...

WordPress plugin Custom Permalinks 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...

CVE-2022-4021

The Permalink Manager Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.2.20.1. This is due to missing or incorrect nonce validation on the extraactions function. This makes it possible for unauthenticated attackers to change plugin settings...

WP Hide <= 0.0.2 - Unauthenticated Settings Update

The plugin does not have authorisation and CSRF checks in place when updating the customwpadminslug settings, allowing unauthenticated attackers to update it with a crafted request curl -X POST --data "customwpadminslug=attacker-value" https://example.com/wp-admin/admin-post.php Settings is...