3520 matches found
Sql injection
In the module "Creative Popup" creativepopup up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection via cpdownloadpopup...
CVE-2023-45381
In the module "Creative Popup" creativepopup up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection via cpdownloadpopup...
PrestaShop SQL Injection Vulnerability
PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides multiple payment methods, SMS alerts and product image scaling. A security vulnerability exists in PrestaShop WebshopWorks, which can be exploited to perform SQL injection via...
CVE-2023-45381
In the module "Creative Popup" creativepopup up to version 1.6.9 from WebshopWorks for PrestaShop, a guest can perform SQL injection via cpdownloadpopup...
PT-2023-29538 · Prestashop · Creative Popup
Name of the Vulnerable Software and Affected Versions: Creative Popup versions up to 1.6.9 Description: A SQL injection issue exists in the Creative Popup module for PrestaShop, allowing a guest to perform SQL injection via the cp download popup function. Recommendations: For versions up to 1.6.9...
CVE-2023-45381
The CVE-2023-45381 affects the Creative Popup module for PrestaShop (WebshopWorks) up to version 1.6.9. A guest can perform SQL injection via the cp_download_popup() function, as described across multiple sources (NVD/Red Hat/CVE listings). The dedicated Red Hat entry confirms the vulnerability i...
WordPress Popup by Supsystic Plugin <= 1.10.19 is vulnerable to Arbitrary File Download
Software Popup by Supsystic Type Plugin Vulnerable versions = 1.10.19 Fixed in 1.10.20 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2023-46197 Patch priority Low CVSS severity Low 5.3 Developer Supsystic PSID deb6d3a6f13c Credits Rafshanzani Suhada Require...
CVE-2023-45357
Archer Platform 6.x before 6.13 P2 HF2 6.13.0.2.2 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. 6.14 6.14.0 is also a fixed release...
CVE-2023-45357
Archer Platform 6.x before 6.13 P2 HF2 6.13.0.2.2 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. 6.14 6.14.0 is also a fixed release...
Information disclosure
Archer Platform 6.x before 6.13 P2 HF2 6.13.0.2.2 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. 6.14 6.14.0 is also a fixed release...
CVE-2023-45357
Archer Platform 6.x before 6.13 P2 HF2 6.13.0.2.2 contains a sensitive information disclosure vulnerability. An authenticated attacker could potentially obtain access to sensitive information via a popup warning message. 6.14 6.14.0 is also a fixed release...
WordPress plugin Popup Builder Information Disclosure Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An information disclosure vulnerability...
PT-2023-7200
Name of the Vulnerable Software and Affected Versions WordPress versions prior to the fixed version Popup Builder WordPress plugin versions through 4.1.15 Description The issue is related to insufficient protection of internal data in the WordPress content management system, allowing remote...
WordPress 6.0 < 6.3.2 Multiple Vulnerabilities
The version of Wordpress Core installed on the remote host are affected by multiple vulnerabilities. - The Popup Builder WordPress plugin through 4.1.15 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting...
WordPress WP Popup Banners Plugin <= 1.2.5 Multiple SQLi Vulnerabilities
The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:accesspressthemes:wppopupbanners"; if description...
Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting
Description The plugin does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup. 1. Create a new PopUp Box within the plugi...
Popup box < 3.7.2 - Admin+ Stored Cross-Site Scripting
Description The plugin does not sanitize and escape some Popup fields, which could allow high-privilege users such as an administrator to inject arbitrary web scripts even when the unfilteredhtml capability is disallowed for example in a multisite setup. PoC 1. Create a new PopUp Box within the...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Meks Video Importer, Meks Time Ago, Meks ThemeForest Smart Widget, Meks Smart Author Widget, Meks Audio Player, Meks Easy Maps, Meks Easy Photo Feed Widget, Meks Simple Flickr Widget, Meks Easy Ads Widget, Meks Smart Social Widget plugins leading...
