CVE-2022-4460

The Sidebar Widgets by CodeLights WordPress plugin through 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used...

CVE-2022-4460

The CVE-2022-4460 entry concerns the WordPress plugin Sidebar Widgets by CodeLights, affected versions 1.4 and earlier. The vulnerability arises from insufficient validation and escaping of shortcode attributes, enabling Stored XSS by attackers with a contributor role, potentially impacting high-...

PT-2023-14515 · Codelights · Sidebar Widgets

Name of the Vulnerable Software and Affected Versions: The Sidebar Widgets by CodeLights WordPress plugin versions 1.4 and earlier Description: The issue allows users with a role as low as a contributor to perform Stored Cross-Site Scripting attacks, which could be used against high-privilege use...

WordPress plugin Sidebar Widgets by CodeLights 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

WordPress Video Sidebar Widgets Plugin <= 6.1 is vulnerable to Cross Site Scripting (XSS)

Software Video Sidebar Widgets Type Plugin Vulnerable versions = 6.1 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4785 Patch priority Medium CVSS severity Medium 6.3 Developer Claim ownership PSID 2859d13481bb Credits István Márton...

Cross-site Scripting (XSS)

github.com/usememos/memos is vulnerable to stored cross-site scripting attacks. The vulnerability exists due to improper user-input sanitization in the sidebar component, which allows an attacker to inject and execute malicious javascript...

Sidebar Widgets by CodeLights <= 1.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC Insert the following shortcode in a post...

CVE-2022-4619

The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2022-4619

The CVE-2022-4619 entry refers to the WordPress plugin Sidebar Widgets by CodeLights. A stored cross-site scripting vulnerability exists in versions up to 1.4 due to insufficient input sanitization and output escaping in the Extra CSS class parameter. Impact applies to multisite installations and...

Sidebar Widgets by CodeLights 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in Sidebar...

XSS in Workflow Comment

Description XSS Vulnerability in Workflow Comment that user can insert javascript payload in comment Proof of Concept 1. navigate to dashboard and workflow settings 2. open the commend in side-bar and insert like this payload test POC:...

OPENSUSE-SU-2022:10239-1 Security update for opera

This update for opera fixes the following issues: Update to 93.0.4585.37 - DNA-102885 Turn on sidebar-autohide on all streams - DNA-103020 Turn on start-page-redesign on developer - DNA-103042 Fix import from Firefox - DNA-103222 Speed Dial Suggestions All opera.com subpages suggestions lead to t...

CVE-2022-3958

Cross-site Scripting XSS vulnerability in BlueSpiceUserSidebar extension of BlueSpice allows user with regular account and edit permissions to inject arbitrary HTML into the personal menu navigation of their own and other users. This allows for targeted attacks...

CVE-2022-29890

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link...

CVE-2022-29890

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link...

CVE-2022-29890

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link...

Cross site scripting

In affected versions of Octopus Server the help sidebar can be customized to include a Cross-Site Scripting payload in the support link...

PT-2022-19896 · Unknown · Octopus Server

Name of the Vulnerable Software and Affected Versions: Octopus Server affected versions not specified Description: The issue allows customization of the help sidebar in Octopus Server to include a Cross-Site Scripting payload in the support link. Recommendations: At the moment, there is no...

Malicious code in bs-sidebar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 205dccdeb1edb92580ab0690e8ca24d862a431a55960aad0a69f0bc7d19ee9d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-1702 Malicious code in bs-sidebar (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 205dccdeb1edb92580ab0690e8ca24d862a431a55960aad0a69f0bc7d19ee9d8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...