8156 matches found
WordPress SEO Title Tag Plugin <= 3.5.9 is vulnerable to Cross Site Scripting (XSS)
Software SEO Title Tag Type Plugin Vulnerable versions = 3.5.9 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-31097 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7390e13eda59 Credits Dimas Maulana Required privilege...
WordPress Change default login logo,url and title Plugin <= 2.0 is vulnerable to Cross Site Request Forgery (CSRF)
Software Change default login logo,url and title Type Plugin Vulnerable versions = 2.0 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-31086 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 9e9f68e4407b Credits...
Ninja Forms Contact Form < 3.8.1 - Author+ Stored XSS
Description The plugin is vulnerable to Stored Cross-Site Scripting via an image title embedded into a form due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages...
CVE-2024-3014
A vulnerability classified as critical has been found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file Actions.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been...
CVE-2024-3014: Improper Neutralization of Special Elements used in an SQL Command
A vulnerability classified as critical has been found in SourceCodester Simple Subscription Website 1.0. Affected is an unknown function of the file Actions.php. The manipulation of the argument title leads to sql injection. It is possible to launch the attack remotely. The exploit has been...
CVE-2024-2996
A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been classified as problematic. Affected is an unknown function of the component Page Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The...
Inventory Management System 安全漏洞
Inventory Management System is an inventory management system for stemword individual developers. A security vulnerability exists in Bdtask Multi-Store Inventory Management System 20240320 and earlier versions, which stems from a cross-site scripting XSS vulnerability in the component Page Title...
PT-2024-23169 · Unknown · Bdtask Multi-Store Inventory Management System
Name of the Vulnerable Software and Affected Versions: Bdtask Multi-Store Inventory Management System versions up to 20240320 Description: A vulnerability was found in the Page Title Handler component of the system, which can lead to cross-site scripting. The manipulation can be launched remotely...
CVE-2024-2996: Improper Neutralization of Input During Web Page Generation
A vulnerability was found in Bdtask Multi-Store Inventory Management System up to 20240320. It has been classified as problematic. Affected is an unknown function of the component Page Title Handler. The manipulation leads to cross site scripting. It is possible to launch the attack remotely. The...
PT-2024-23209 · Sourcecodester · Sourcecodester Simple Subscription Website
Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Subscription Website version 1.0 Description: A critical vulnerability has been found in the software. The issue is related to the manipulation of the title argument, which leads to SQL injection. This can be exploited...
Fancy Product Designer < 6.1.81 - Admin+ Cross Site Scripting via Product Title
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC Note: This requires WooCommerce to...
NPS computy < 2.7.6 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to "Settings NPS Monitoring" 2...
CVE-2024-25807
Cross Site Scripting XSS vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album...
CVE-2024-25807
Cross Site Scripting XSS vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album...
CVE-2024-25807: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS vulnerability in Lychee 3.1.6, allows remote attackers to execute arbitrary code and obtain sensitive information via the title parameter when creating an album...
Lychee 安全漏洞
Lychee is a beautiful and easy to use photo management system from The Lychee Organisation open source. It is used to manage and share photos. A security vulnerability exists in Lychee version 3.1.6, which stems from a cross-site scripting XSS vulnerability. The vulnerability can be exploited by ...
GHSA-XGJ4-2HRF-J4XG Cross-site scripting in Survey Creator
Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...
CVE-2024-28635
Cross Site Scripting XSS vulnerability in SurveyJS Survey Creator v.1.9.132 and before, allows attackers to execute arbitrary code and obtain sensitive information via the title parameter in form...
Survey Creator Library 跨站脚本漏洞
Survey Creator Library is SurveyJS open source a GUI-based no-code form generator library . A cross-site scripting vulnerability exists in Survey Creator Library v.1.9.132 and earlier versions that could allow an attacker to execute arbitrary code and obtain sensitive information via the title...
