2783 matches found
WordPress YITH WooCommerce Tab Manager Plugin <= 1.35.0 is vulnerable to Cross Site Scripting (XSS)
Software YITH WooCommerce Tab Manager Type Plugin Vulnerable versions = 1.35.0 Fixed in 1.35.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35698 Patch priority Low CVSS severity Low 5.9 Developer YITH PSID d6384d72bb85 Credits savphill Required privilege Editor...
CVE-2024-5418
The DethemeKit For Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'slitems' attribute within the plugin's De Product Tab & Slide widget in all versions up to, and including, 2.1.4 due to insufficient input sanitization and output escaping on user supplied...
CVE-2024-5418
CVE-2024-5418 : The DethemeKit For Elementor WordPress plugin has a Stored Cross-Site Scripting (XSS) flaw in the De Product Tab & Slide widget via the slitems attribute. The issue affects all versions up to 2.1.4 due to insufficient input sanitization and output escaping for user-supplied attrib...
GHSA-MQJC-X563-C9Q8 silverstripe/framework CSV Excel Macro Injection
In the CSV export feature of the CMS it's possible for the output to contain macros and scripts, which if imported without sanitisation into software including Microsoft Excel may be executed. In order to safeguard against this threat all potentially executable cell values exported from CSV will ...
PT-2024-40381 · Microsoft · Office Excel
Name of the Vulnerable Software and Affected Versions: CMS affected versions not specified Description: The issue concerns the CSV export feature of the CMS, where the output can contain macros and scripts. If these are imported into software like Microsoft Excel without proper sanitization, they...
CVE-2023-1111
A vulnerability was found in FastCMS up to 0.1.5 and classified as problematic. Affected by this issue is some unknown functionality of the component New Article Tab. The manipulation of the argument Title leads to cross site scripting. The attack may be launched remotely. The exploit has been...
CVE-2023-1111 FastCMS New Article Tab cross site scripting
A vulnerability was found in FastCMS up to 0.1.5 and classified as problematic. Affected by this issue is some unknown functionality of the component New Article Tab. The manipulation of the argument Title leads to cross site scripting. The attack may be launched remotely. The exploit has been...
CVE-2023-1111 FastCMS New Article Tab cross site scripting
A vulnerability was found in FastCMS up to 0.1.5 and classified as problematic. Affected by this issue is some unknown functionality of the component New Article Tab. The manipulation of the argument Title leads to cross site scripting. The attack may be launched remotely. The exploit has been...
PT-2024-40127 · Packagist · Silverstripe Cms
Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned. Description: A cross-site scripting issue has been found in the CMS page history tab. This can be exploited if a user with CMS access posts malicious or unescaped HTML into any text fields on a...
CVE-2024-1429
The Element Pack Elementor Addons Header Footer, Free Template Library, Grid, Carousel, Table, Parallax Animation, Register Form, Twitter Grid plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘tablink’ attribute of the Panel Slider widget in all versions up to, and...
PT-2024-24591 · Phlex · Phlex
Name of the Vulnerable Software and Affected Versions: phlex versions prior to 1.10.1 phlex versions prior to 1.9.2 phlex versions prior to 1.8.3 phlex versions prior to 1.7.2 phlex versions prior to 1.6.3 phlex versions prior to 1.5.3 phlex versions prior to 1.4.2 Description: There is a potenti...
Brave Android 1.65.114 Security Fixes
Fixed website title of last closed private tab being displayed as reported on HackerOne by thesur. Upgraded Chromium to 124.0.6367.60 — refer to Google Chrome advisories for inherited CVEs...
WordPress BizCalendar Web plugin <= 1.1.0.25 - Reflected Cross-Site Scripting via 'tab' vulnerability
Reflected Cross-Site Scripting via 'tab' vulnerability discovered by WordFence in WordPress Plugin bizcalendar-web versions = 1.1.0.25...
PT-2024-18301 · WordPress · Bizcalendar Web
Name of the Vulnerable Software and Affected Versions: BizCalendar Web plugin for WordPress versions up to, and including, 1.1.0.19 Description: The issue is related to Reflected Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows unauthenticated attackers...
WordPress Plugin BizCalendar Web 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...
CVE-2024-1587
The Newsmatic theme for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.3.0 via the 'newsmaticfilterpostsloadtabcontent'. This makes it possible for unauthenticated attackers to view draft posts and post content...
PT-2024-18151 · WordPress · Newsmatic
Name of the Vulnerable Software and Affected Versions: Newsmatic theme for WordPress versions up to, and including, 1.3.0 Description: The issue allows unauthenticated attackers to view draft posts and post content due to Sensitive Information Exposure. This is possible via the newsmatic filter...
dotCMS 安全漏洞
DotCMS is an open source content management system written in Java by DotCMS, Inc. for managing content and content-driven sites and applications. A security vulnerability exists in dotCMS that stems from the fact that any user with portlet privileges can access the Tools and Log Files tabs under...
WordPress Plugin WP Responsive Tabs horizontal vertical and accordion Tabs 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...
CLSA-2024-1711564698 Update of alt-php
New upstream 2024a version: - Kazakhstan unifies on UTC+5 beginning 2024-03-01. - Palestine springs forward a week later after Ramadan. - zic no longer pretends to support indefinite-past DST. - localtime no longer mishandles Ciudad Juárez in 2422. New upstream 2023d version: - Ittoqqortoormiit,...