CVE-2023-49396

CVE-2023-49396 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability exposed via the /admin/category/save endpoint. The issue originates from CSRF in how this endpoint handles requests, enabling potential unauthorized actions if a user is tricked into submitting a reques...

CVE-2023-49446

Summary: CVE-2023-49446 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) issue exposed via the /admin/nav/save endpoint. The public dossier consistently identifies the vulnerability and its target, but does not provide a confirmed patch version or vendor remediation details. Root...

CVE-2023-49372

JFinalCMS v5.0.0 is affected by a Cross-Site Request Forgery (CSRF) vulnerability exploitable via the /admin/slide/save endpoint. Root cause is a CSRF weakness in that API path, as reported across multiple sources. CVSSv3.1 vector indicates high baseline impact (C/H, I/H, A/H) with no privileges ...

CVE-2023-49446

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/nav/save...

CVE-2023-49378

CVE-2023-49378 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability exposed via the /admin/form/save endpoint. Root cause: CSRF in that API path. Impact is high across confidentiality, integrity, and availability (per NVD metrics: CVSS 3.1 base score 8.8, HIGH). Connect...

JFinalCMS Security Vulnerability

JFinalCMS is a content management system by heyewei personal developer. A security vulnerability exists in JFinalCMS v5.0.0, which originates from a cross-site request forgery vulnerability in the /admin/slide/save component...

CVE-2023-49383

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/tag/save...

CVE-2023-49372

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/slide/save...

CVE-2023-49396

JFinalCMS v5.0.0 was discovered to contain a Cross-Site Request Forgery CSRF vulnerability via /admin/category/save...

UBUNTU-CVE-2023-40074

In saveToXml of PersistableBundle.java, invalid data could lead to local persistent denial of service with no additional execution privileges needed. User interaction is not needed for exploitation...

Download canvasio3D Light <= 2.5.0 - Subscriber+ Entries Update/Deletion

Description The plugin is vulnerable to unauthorized access & modification of data due to a missing capability check on the caARConnect function, allowing authenticated attackers, with subscriber-level access and above, to retrieve data from the plugin and save/delete entries...

Confluence XHR requests have the wrong content type

h3. Problem Watching or Stop watching a Confluence page and other operations see below list of identified endpoints will generate a request like the one below copied as curl from HAR capture for convenience: code:java curl 'https://confluence/rest/api/user/watch/content/9999999' \ -X 'DELETE' \ -...

CVE-2023-47844

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4...

CVE-2023-47844

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4...

CVE-2023-47844

CVE-2023-47844 affects the WordPress plugin Grab & Save (versions

CVE-2023-47844 WordPress Grab & Save Plugin <= 1.0.4 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4...

WordPress Plugin Grab & Save Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-47844: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Lim Kai Yang Grab & Save allows Reflected XSS.This issue affects Grab & Save: from n/a through 1.0.4...

PT-2023-30641

Name of the Vulnerable Software and Affected Versions Lim Kai Yang Grab & Save versions 1.0.4 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, allowing Reflected XSS. This enables potential attackers t...