8152 matches found
CVE-2023-3201
The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstoreupdatenewordertitle function. This makes it possible for unauthenticated attackers to update new order title via a forged request granted they can trick a site administrato...
PT-2023-23567
Name of the Vulnerable Software and Affected Versions MStore API plugin for WordPress affected versions not specified Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the mstore update new order title function. This allows unauthenticated attackers...
MStore API < 3.9.7 - Multiple CSRF
The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as Order Status Update, Order Title Update, Product Limit Update, Order Message Update, and Firebase Server Key Update...
CVE-2023-22585
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter...
Cross site scripting
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter...
CVE-2023-22585 Reflected Cross-Site Scripting in Danfoss AK-EM100
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter...
Danfoss AK-EM100 web applications 跨站脚本漏洞
Danfoss AK-EM100 web applications is a web application from Danfoss, Denmark. It provides the store's web-based graphical user interface, which allows a range of everyday users to locally or remotely monitor data, alarms, and reports on all of their refrigeration equipment. A security vulnerabili...
PT-2023-18570 · Danfoss · Danfoss Ak-Em100
Name of the Vulnerable Software and Affected Versions: Danfoss AK-EM100 affected versions not specified Description: The issue concerns Reflected Cross-Site Scripting in the title parameter of the web application. This allows for potential malicious script injection. Recommendations: At the momen...
CVE-2023-22585: Improper Neutralization of Input During Web Page Generation
The Danfoss AK-EM100 web applications allow for Reflected Cross-Site Scripting in the title parameter...
CVE-2021-4365
The Frontend File Manager plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting in versions up to, and including, 18.2. This is due to lacking authentication protections and santisation all on the wpfmeditfiletitledesc AJAX action. This makes it possible for...
SourceCodester Online Discussion Forum Site 跨站脚本漏洞
SourceCodester Online Discussion Forum Site is an application from SourceCodester, Inc. An Online Discussion Forum. A cross-site scripting vulnerability exists in Online Discussion Forum Site version 1.0, which stems from cross-site scripting due to incorrect manipulation of the parameter title...
PT-2023-12480 · WordPress · Frontend File Manager
Name of the Vulnerable Software and Affected Versions: Frontend File Manager plugin for WordPress versions up to, and including, 18.2 Description: The issue arises from lacking authorization protections, checks against users editing other's posts, and a missing security nonce on the "wpfm edit fi...
CVE-2023-3144: Improper Neutralization of Input During Web Page Generation
A vulnerability classified as problematic was found in SourceCodester Online Discussion Forum Site 1.0. Affected by this vulnerability is an unknown functionality of the file admin\posts\managepost.php. The manipulation of the argument title leads to cross site scripting. The attack can be launch...
PT-2023-24683 · Unknown · Taosdata/Grafanaplugin
Name of the Vulnerable Software and Affected Versions: taosdata/grafanaplugin affected versions not specified Description: The issue concerns a command injection vulnerability in the Release PR Merged workflow. This vulnerability allows for arbitrary code execution within the GitHub action contex...
PT-2023-16789 · WordPress · Bookly
Name of the Vulnerable Software and Affected Versions: Bookly plugin for WordPress versions up to, and including, 21.5 Description: The issue is related to Stored Cross-Site Scripting via service titles due to insufficient input sanitization and output escaping. This allows authenticated attacker...
CVE-2023-3015
A vulnerability has been found in yiwent Vip Video Analysis 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file data/title.php. The manipulation of the argument titurl leads to server-side request forgery. The attack can be launched remotely. The...
PT-2023-22558 · Unknown · Yiwent Vip Video Analysis
Name of the Vulnerable Software and Affected Versions: yiwent Vip Video Analysis version 1.0 Description: A critical issue has been found in the software, affecting an unknown functionality of the file data/title.php. The manipulation of the titurl argument leads to server-side request forgery...
CVE-2023-24602
OX App Suite before frontend 7.10.6-rev24 allows XSS via data to the Tumblr portal widget, such as a post title...