CVE-2024-31984 XWiki Platform: Remote code execution through space title and Solr space facet

XWiki Platform is a generic wiki platform. Starting in version 7.2-rc-1 and prior to versions 4.10.20, 15.5.4, and 15.10-rc-1, by creating a document with a specially crafted title, it is possible to trigger remote code execution in the Solr-based search in XWiki. This allows any user who can edi...

XWiki Platform 安全漏洞

XWiki Platform is the XWiki Foundation's suite of Wiki platforms for creating collaborative Web applications. A security vulnerability exists in XWiki Platform that originates from a remote code execution that can be triggered in a search in XWiki by creating a document with a specially crafted...

Leantime Systems Leantime 安全漏洞

Leantime Systems Leantime is an open source PHP and MySQL based project management system from Leantime Systems, Inc. A security vulnerability exists in Leantime Systems Leantime version 3.0.6, which stems from the presence of a cross-site scripting vulnerability that allows an attacker to inject...

PT-2024-21916 · Leantime · Leantime

Name of the Vulnerable Software and Affected Versions: Leantime version 3.0.6 Description: A Cross-Site Scripting issue exists within the ticket creation and modification functionality, allowing attackers to inject malicious JavaScript code into the title field of tickets. This stored XSS issue c...

CVE-2024-2787

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Page Title HTML Tag in all versions up to, and including, 3.10.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-2788

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Post Title HTML Tag in all versions up to, and including, 3.10.4 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticate...

CVE-2024-2786

The Happy Addons for Elementor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several widgets in all versions up to, and including, 3.10.4 due to insufficient input sanitization and output escaping on the titletag attribute. This makes it possible for authenticated attacker...

PT-2024-22086 · WordPress · Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.10.4 Description: The issue is related to Stored Cross-Site Scripting via several widgets due to insufficient input sanitization and output escaping on the...

WordPress Plugin Stackable 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

PT-2024-22104 · WordPress · Happy Addons For Elementor

Name of the Vulnerable Software and Affected Versions: The Happy Addons for Elementor plugin for WordPress versions up to, and including, 3.10.4 Description: The issue is related to Stored Cross-Site Scripting via the Post Title HTML Tag due to insufficient input sanitization and output escaping ...

WordPress Plugin Happy Addons for Elementor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2024-18656 · WordPress · Stackable – Page Builder Gutenberg Blocks

Name of the Vulnerable Software and Affected Versions: The Stackable – Page Builder Gutenberg Blocks plugin for WordPress versions up to, and including, 3.12.11 Description: The issue is related to Stored Cross-Site Scripting via the Postv2 block title tag due to insufficient input sanitization a...

HTMLy 2.9.6 Cross Site Scripting

Exploit Title: HTMLy Version : 2.9.6 - Stored XSS Exploit Author: tmrswrr Vendor Homepage: https://www.htmly.com/ Version 3.10.8.21 Date : 04/08/2024 1 Login admin https://127.0.0.1/HTMLy/admin/config 2 General Setting Blog title " 3 After save it you will be see xss alert...

PT-2024-25760 · Unknown · Sourcecodester Online Courseware

Name of the Vulnerable Software and Affected Versions: SourceCodester Online Courseware version 1.0 Description: A critical issue has been found in the software. The problem is related to an unknown function in the file admin/listscore.php, where the manipulation of the title argument leads to SQ...

Online Courseware SQL注入漏洞

DPEC Online Courseware is an online courseware system from DPEC Corporation. A SQL injection vulnerability exists in version 1.0 of Online Courseware, which originates from an SQL injection attack in the title parameter of the admin/listscore.php file...

Online Library System SQL注入漏洞

Online Library System is an open source online library system. A SQL injection vulnerability exists in SourceCodester Online Library System version 1.0, which originates from a SQL injection vulnerability in the BookPublisher/BookTitle parameter of the admin/borrowed/index.php file...

Internship Portal Management System SQL注入漏洞

Internship Portal Management System is an internship portal management system by the individual developer ChatikoboL. A SQL injection vulnerability exists in Internship Portal Management System version 1.0, which originates from a SQL injection vulnerability in the title/description/start/end...

SEO Title Tag <= 3.5.9 - Reflected Cross-Site Scripting

Description The SEO Title Tag plugin for WordPress is vulnerable to Reflected Cross-Site Scripting in versions up to, and including, 3.5.9 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that...

CVE-2024-2839

The Colibri Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'colibriposttitle' shortcode in all versions up to, and including, 1.0.263 due to insufficient input sanitization and output escaping on user supplied attributes such as 'headingtype'. This...

PT-2024-22409 · WordPress · Colibri Page Builder

Name of the Vulnerable Software and Affected Versions: Colibri Page Builder plugin for WordPress versions up to, and including, 1.0.263 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes, such as heading type, in the plugin's 'colibr...