11511 matches found
CVE-2022-27854
Stored Cross-Site Scripting XSS vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin = 0.21.19 on WordPress possible for users with contributor or higher role via &wpttestpagesubmitbuttoncaption parameter...
CVE-2022-27854
Stored Cross-Site Scripting XSS vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin = 0.21.19 on WordPress possible for users with contributor or higher role via &wpttestpagesubmitbuttoncaption parameter...
Cross site scripting
Stored Cross-Site Scripting XSS vulnerability in Alexander Ustimenko's Psychological tests & quizzes plugin = 0.21.19 on WordPress possible for users with contributor or higher role via &wpttestpagesubmitbuttoncaption parameter...
Psychological tests & quizzes <= 0.21.19 - Contributor+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings available to users with a role as low as contributor, allowing them to perform Cross-Site Scripting attacks...
CVE-2022-29417
Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin = 3.3.1 at WordPress allows an attacker with a low user role like a subscriber or higher to change the plugin settings...
CVE-2022-29419
SQL Injection SQLi vulnerability in Don Crowther's 3xSocializer plugin = 0.98.22 at WordPress possible for users with a low role like a subscriber or higher...
Sql injection
SQL Injection SQLi vulnerability in Don Crowther's 3xSocializer plugin = 0.98.22 at WordPress possible for users with a low role like a subscriber or higher...
CVE-2022-29419 WordPress 3xSocializer plugin <= 0.98.22 - Authenticated SQL Injection (SQLi) vulnerability
SQL Injection SQLi vulnerability in Don Crowther's 3xSocializer plugin = 0.98.22 at WordPress possible for users with a low role like a subscriber or higher...
CVE-2022-29418
CVE-2022-29418 affects the WordPress plugin Night Mode (Mark Daniels Night Mode) at versions
CVE-2022-29417
Summary: CVE-2022-29417 affects the WordPress ShortPixel Adaptive Images plugin (versions
CVE-2022-29418
Authenticated admin user role Persistent Cross-Site Scripting XSS in Mark Daniels Night Mode plugin = 1.0.0 on WordPress via vulnerable parameters: pagesettingenable-me, pagesettingbg-color, pagesettingtxt-color, pagesettinganccolor...
barbican 授权问题漏洞
barbican is an OpenStack key management service, API server. An authorization issue vulnerability exists in barbican due to a lack of authorization checks. A remote user with the administrator role could add secrets to different project containers. The vulnerability allows an attacker on a networ...
Ubuntu 18.04 LTS / 20.04 LTS : Barbican vulnerabilities (USN-5387-1)
The remote Ubuntu 18.04 LTS / 20.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-5387-1 advisory. Douglas Mendizbal discovered that Barbican incorrectly handled access restrictions. An authenticated attacker could possibly use this issue t...
Improper authorization - receptionist can read all secure messaging
Description Hi there openemr maintainers, I would like to report an improper authorization vulnerability in your source code. Proof of Concept 1. Install openemr in your system and create an admin account and a receptionist account 2. Use admin account and create a secure message by go to Portal...
CVE-2022-27340
MCMS v5.2.7 contains a Cross-Site Request Forgery CSRF via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data...
CVE-2022-27340
MCMS v5.2.7 contains a Cross-Site Request Forgery CSRF via /role/saveOrUpdateRole.do. This vulnerability allows attackers to escalate privileges and modify data...
MingSoft MCMS 跨站请求伪造漏洞
MingSoft MCMS is a complete open source J2ee system from MingSoft. A cross-site request forgery vulnerability exists in MingSoft MCMS v5.2.7, which stems from a lack of cross-site request forgery filtering in the file /role/saveOrUpdateRole.do. An attacker can exploit this vulnerability to elevat...
CVE-2022-28438
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=User&userid=...