Cross site scripting

A vulnerability was found in Bug Finder Listplace Directory Listing Platform 3.0. It has been classified as problematic. This affects an unknown part of the file /listplace/user/coverPhotoUpdate of the component Photo Handler. The manipulation of the argument usercoverphoto leads to cross site...

CVE-2023-3828 Bug Finder Listplace Directory Listing Platform Photo coverPhotoUpdate cross site scripting

A vulnerability was found in Bug Finder Listplace Directory Listing Platform 3.0. It has been classified as problematic. This affects an unknown part of the file /listplace/user/coverPhotoUpdate of the component Photo Handler. The manipulation of the argument usercoverphoto leads to cross site...

photo-catalysis.org Cross Site Scripting vulnerability OBB-3537170

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

PT-2023-26342 · Unknown · Bug Finder Listplace Directory Listing Platform

Name of the Vulnerable Software and Affected Versions: Bug Finder Listplace Directory Listing Platform version 3.0 Description: A vulnerability was found in the Bug Finder Listplace Directory Listing Platform, affecting an unknown part of the file /listplace/user/coverPhotoUpdate of the component...

Bug Finder Listplace 跨站脚本漏洞

Bug Finder Listplace is a powerful directory listing platform from Bug Finder, Inc. A cross-site scripting vulnerability exists in Bug Finder Listplace version 3.0, which stems from an unknown function in file /listplace/user/coverPhotoUpdate in the component Photo Handler, leading to cross-site...

WordPress Photo Engine Plugin <= 6.2.5 is vulnerable to Insecure Direct Object References (IDOR)

Software Photo Engine Type Plugin Vulnerable versions = 6.2.5 Fixed in 6.2.6 OWASP Top 10 A5: Broken Access Control Classification Insecure Direct Object References IDOR CVE CVE-2023-38513 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID fe9d14feafc3 Credits Rafshanzani...

WordPress Image Photo Gallery Final Tiles Grid Plugin <= 3.5.6 is vulnerable to Cross Site Scripting (XSS)

Software Image Photo Gallery Final Tiles Grid Type Plugin Vulnerable versions = 3.5.6 Fixed in 3.5.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 37480a127ac6 Credits Rafie Muhammad...

WordPress WP Photo Effects Plugin <= 1.2.4 is vulnerable to Cross Site Scripting (XSS)

Software WP Photo Effects Type Plugin Vulnerable versions = 1.2.4 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 83f7978cf7eb Credits Rafie Muhammad Patchstack Require...

ImpressCMS Cross-Site Scripting Vulnerability (CNVD-2023-59104)

ImpressCMS is a MySQL-based, modular content management system CMS. The system includes modules for press releases, forums and photo albums. A cross-site scripting vulnerability exists in ImpressCMS v1.4.5 and earlier versions, which stems from the lack of effective filtering and escaping of...

CVE-2021-4415

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...

CVE-2021-4415

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...

Cross site request forgery (csrf)

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...

CVE-2021-4415 Sunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery Bypass

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...

CVE-2021-4415 Sunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery Bypass

The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...

CVE-2021-4415

The CVE-2021-4415 issue affects the Sunshine Photo Cart WordPress plugin up to version 2.8.28, due to missing/incorrect nonce validation in sunshine_products_quicksave_post(). This CSRF flaw lets unauthenticated attackers save custom post data by tricking an admin into a forged request. The vulne...

PT-2023-12527 · WordPress · Sunshine Photo Cart

Name of the Vulnerable Software and Affected Versions: Sunshine Photo Cart plugin for WordPress versions up to, and including, 2.8.28 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the sunshine products quicksave post function. This...

WordPress Plugin Sunshine Photo Cart 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

Piwigo v13.7.0 - Stored Cross-Site Scripting (Authenticated) Vulnerability

Exploit Title: Piwigo v13.7.0 - Stored Cross-Site Scripting XSS Authenticated Exploit Author: Okan Kurtulus Vendor Homepage: https://piwigo.org Version: 13.7.0 Tested on: Ubuntu 22.04 CVE : N/A Proof of Concept: 1– Install the system through the website and log in with any user authorized to uplo...

CVE-2023-37270

Summary: CVE-2023-37270 affects Piwigo prior to 13.8.0, with a SQL Injection in the administrator login flow where the User-Agent related query is vulnerable at the endpoint recording user information. The vulnerability can be exploited by an authenticated attacker (admin screen login with low pr...

CVE-2023-3538

A vulnerability classified as problematic was found in SimplePHPscripts Photo Gallery PHP 2.0. This vulnerability affects unknown code of the file /preview.php of the component URL Parameter Handler. The manipulation leads to cross site scripting. The attack can be initiated remotely. VDB-233290 ...