Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the Page URL variable. An attacker can manipulate web content or hijack user sessions by injecting malicious scripts into the URL parameter. Details Cross-site scripting or XSS is a code vulnerability th...

CVE-2024-8737

The PDF Thumbnail Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting due to the use of addqueryarg without appropriate escaping on the URL in all versions up to, and including, 1.3. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in...

CVE-2024-5870

The Tweaker5 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CVE-2024-5869: Improper Neutralization of Input During Web Page Generation

The Neighborly theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, wit...

PT-2024-37208

Name of the Vulnerable Software and Affected Versions: The Neighborly theme for WordPress versions up to, and including, 1.4 Description: The issue is related to Stored Cross-Site Scripting via the url parameter within the theme's Button shortcode due to insufficient input sanitization and output...

CVE-2024-5870: Improper Neutralization of Input During Web Page Generation

The Tweaker5 theme for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘url’ parameter within the theme's Button shortcode in all versions up to, and including, 1.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

WordPress Elementor Website Builder plugin <= 3.23.4 - Authenticated (Contributor+) Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting in the URL Parameter in Multiple Widgets vulnerability discovered by wesley wcraft in WordPress Plugin Elementor Website Builder versions = 3.23.4...

CVE-2024-5416: Improper Neutralization of Input During Web Page Generation

The Elementor Website Builder – More than Just a Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url parameter of multiple widgets in all versions up to, and including, 3.23.4 due to insufficient input sanitization and output escaping on user supplied...

CVE-2024-44721: Server-Side Request Forgery (SSRF)

SeaCMS v13.1 was discovered to a Server-Side Request Forgery SSRF via the url parameter at /adminreslib.php...

CVE-2024-44721

SeaCMS v13.1 was discovered to a Server-Side Request Forgery SSRF via the url parameter at /adminreslib.php...

CVE-2024-29729

SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/generateShortURL/, parameter url...

CVE-2024-29729

CVE-2024-29729 affects SportsNET, version 4.0.1. The vulnerability is a SQL injection in the API endpoint at /app/ax/generateShortURL/ with the vulnerable parameter url, enabling an attacker to retrieve, update, and delete data in the database. Documented impact is high across confidentiality, in...

CVE-2024-29729: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerabilities in SportsNET affecting version 4.0.1. These vulnerabilities could allow an attacker to retrieve, update and delete all information in the database by sending a specially crafted SQL query: https://XXXXXXX.saludydesafio.com/app/ax/generateShortURL/, parameter url...

PT-2024-22973 · Sportsnet · Sportsnet

Name of the Vulnerable Software and Affected Versions: SportsNET version 4.0.1 Description: The issue concerns SQL injection vulnerabilities that could allow an attacker to retrieve, update, and delete all information in the database by sending a specially crafted SQL query. The vulnerable...

CVE-2024-39097

There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the url parameter in login path...

CVE-2024-39097: URL Redirection to Untrusted Site

There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the url parameter in login path...

CVE-2024-39097

There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the "url" parameter in login path...

CVE-2024-39097

There is an Open Redirect vulnerability in Gnuboard v6.0.4 and below via the url parameter in login path...

CVE-2024-39097

Gnuboard versions 6.0.4 and below are susceptible to an Open Redirect vulnerability. The root cause is a flaw in the url parameter within the login path , which can be exploited by an attacker to redirect users to a malicious website. To mitigate this issue, it is recommended to upgrade to versio...

PT-2024-38839 · Unknown · Sourcecodester Qr Code Bookmark System

Name of the Vulnerable Software and Affected Versions: SourceCodester QR Code Bookmark System version 1.0 Description: A vulnerability was found in the SourceCodester QR Code Bookmark System, affecting the file /endpoint/add-bookmark.php of the component Parameter Handler. The manipulation of the...