ClassCMS 安全漏洞

ClassCMS is a simple, flexible, secure and easy-to-expand content management system from China ClassCMS open source. A security vulnerability exists in ClassCMS version 4.8, which originates from the parameter Title in the file /index.php/admin can lead to cross-site scripting...

PT-2024-38834 · Classcms · Classcms

Name of the Vulnerable Software and Affected Versions: ClassCMS version 4.8 Description: A vulnerability has been found in ClassCMS, affecting some unknown functionality of the file /index.php/admin of the component Article Handler. The manipulation of the Title argument leads to basic cross-site...

CVE-2024-42550

A cross-site scripting XSS vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter...

WordPress WordSurvey plugin <= 3.2 - Authenticated (Administrator+) Stored Cross-Site Scripting via sounding_title Parameter vulnerability

Authenticated Administrator+ Stored Cross-Site Scripting via soundingtitle Parameter vulnerability discovered by Artem Polynko Artem Polynko in WordPress Plugin WordSurvey versions = 3.2...

Mini Inventory and Sales Management System 安全漏洞

Mini Inventory and Sales Management System is a small inventory and sales management system written in PHP CodeIgniter framework that supports MySQL and Sqlite3 databases. A security vulnerability exists in Mini Inventory and Sales Management System. An attacker can exploit this vulnerability to...

CVE-2024-42550

A cross-site scripting XSS vulnerability in the component /email/welcome.php of Mini Inventory and Sales Management System commit 18aa3d allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title parameter...

CVE-2024-42550

CVE-2024-42550 is an XSS vulnerability in the Mini Inventory and Sales Management System, exploitable via the /email/welcome.php component (commit 18aa3d). The issue arises from injecting a crafted payload into the Title parameter, enabling execution of arbitrary scripts/HTML in a victim’s browse...

CVE-2024-5932

The GiveWP – Donation Plugin and Fundraising Platform plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.14.1 via deserialization of untrusted input from the 'givetitle' parameter. This makes it possible for unauthenticated attackers to inject a PHP...

PT-2024-37859 · WordPress · Wordsurvey

Name of the Vulnerable Software and Affected Versions: WordSurvey plugin for WordPress versions up to, and including, 3.2 Description: The issue is related to Stored Cross-Site Scripting via the sounding title parameter due to insufficient input sanitization and output escaping. This allows...

CVE-2024-7660

A vulnerability has been found in SourceCodester File Manager App 1.0 and classified as problematic. Affected by this vulnerability is an unknown functionality of the component Add File Handler. The manipulation of the argument File Title/Uploaded By leads to cross site scripting. The attack can ...

SourceCodester File Manager 安全漏洞

SourceCodester File Manager is a file manager. A security vulnerability exists in SourceCodester File Manager version 1.0, which stems from a cross-site scripting vulnerability in the File Title/Uploaded By parameter of the Add File Handler component...

PT-2024-38488 · Unknown · Sourcecodester File Manager App

Name of the Vulnerable Software and Affected Versions: SourceCodester File Manager App version 1.0 Description: A vulnerability has been found in the SourceCodester File Manager App, affecting an unknown functionality of the component Add File Handler. The manipulation of the argument File...

WordPress Element Pack Elementor Addons plugin <= 5.7.6 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via titletag vulnerability discovered by Ngô Thiên An ancorn in WordPress Plugin Element Pack Elementor Addons versions = 5.7.6...

CVE-2024-6824

The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'checktempvalidity' and 'updatetemplatetitle' functions in all versions up to, and including, 4.10.38. This makes it possible for authenticate...

CVE-2024-6824 Premium Addons for Elementor <= 4.10.38 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion and Arbitrary Title Update

The Premium Addons for Elementor plugin for WordPress is vulnerable to unauthorized modification and loss of data due to a missing capability check on the 'checktempvalidity' and 'updatetemplatetitle' functions in all versions up to, and including, 4.10.38. This makes it possible for authenticate...

WordPress Premium Addons for Elementor plugin <= 4.10.38 - Missing Authorization to Authenticated (Contributor+) Arbitrary Content Deletion and Arbitrary Title Update vulnerability

Missing Authorization to Authenticated Contributor+ Arbitrary Content Deletion and Arbitrary Title Update vulnerability discovered by stealthcopter in WordPress Plugin Premium Addons for Elementor versions = 4.10.38...

PT-2024-38299 · Sourcecodester · Sourcecodester Simple Realtime Quiz System

Name of the Vulnerable Software and Affected Versions: SourceCodester Simple Realtime Quiz System version 1.0 Description: A problematic issue has been found, affecting the /ajax.php?action=save quiz file. The manipulation of the title argument leads to cross-site scripting. This issue can be...

CVE-2024-6408

The Slider by 10Web WordPress plugin before 1.2.57 does not sanitise and escape its Slider Title, which could allow high privilege users such as editors and above to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2024-6408

CVE-2024-6408 affects the Slider by 10Web WordPress plugin, prior to version 1.2.57. The flaw is an insufficient sanitization/escaping of the Slider Title, enabling Cross‑Site Scripting by high‑privilege users (e.g., Editors) even when unfiltered_html is disallowed. Red Hat confirms the issue tex...

Cross-Site Scripting (XSS)

com.jfinal, jfinal is vulnerable to Cross-site scripting. The vulnerability is due to improper input validation in the Title parameter in the /admin/content file, which can be manipulated to inject malicious scripts. Attackers can exploit this vulnerability remotely to execute arbitrary scripts i...