2942 matches found
PT-2025-1786 · WordPress · Deliver Via Shipos For Woocommerce
Name of the Vulnerable Software and Affected Versions: Deliver via Shipos for WooCommerce plugin for WordPress versions up to, and including, 2.1.7 Description: The issue is related to Reflected Cross-Site Scripting via the dvsfw bulk label url parameter due to insufficient input sanitization and...
bookstore 安全漏洞
bookstore is an e-commerce bookstore system by donglight individual developer. A security vulnerability exists in bookstore version 1.0.0, which originates from the parameter url in the file src/main/java/org/zdd/bookstore/rawl/HttpUtil.java that can lead to a server-side request forgery attack...
PT-2025-2029 · Unknown · Zerowdd Studentmanager
Name of the Vulnerable Software and Affected Versions: ZeroWdd studentmanager version 1.0 Description: A vulnerability was found in the submitAddPermission function of the PermissionController.java file. The manipulation of the url argument leads to cross-site scripting. The attack may be initiat...
CVE-2025-22387
An issue was discovered in Optimizely Configured Commerce before 5.2.2408. A medium-severity issue exists in requests for resources where the session token is submitted as a URL parameter. This exposes information about the authenticated session, which can be leveraged for session hijacking...
PT-2024-9925 · Unknown · Code-Projects Job Recruitment
Name of the Vulnerable Software and Affected Versions: code-projects Job Recruitment version 1.0 Description: A critical issue affects the cn update function of the file / parse/ all edits.php. The manipulation of the cname and url arguments leads to SQL injection. The attack may be initiated...
WordPress plugin Feedify – Web Push Notifications 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. WordPress plugin is an application plugin. A cross-site scripting vulnerabili...
PT-2024-17267 · WordPress · Feedify – Web Push Notifications
Name of the Vulnerable Software and Affected Versions: The Feedify – Web Push Notifications plugin for WordPress versions up to, and including, 2.4.2 Description: The issue is related to Reflected Cross-Site Scripting via the platform, phone, email, and store url parameters due to insufficient...
PT-2024-17630 · Classcms · Classcms
Name of the Vulnerable Software and Affected Versions: ClassCMS version 4.8 Description: A problematic vulnerability was found in ClassCMS, affecting an unknown functionality of the file /index.php/admin of the component Model Management Page. The manipulation of the URL argument leads to...
CVE-2024-11204
The ForumWP – Forum & Discussion Board plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the ‘url’ parameter in all versions up to, and including, 2.1.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to injec...
PT-2024-16822 · WordPress · Forumwp
Name of the Vulnerable Software and Affected Versions: ForumWP – Forum & Discussion Board plugin for WordPress versions up to, and including, 2.1.2 Description: The issue is related to Reflected Cross-Site Scripting via the url parameter due to insufficient input sanitization and output escaping...
CVE-2024-48962 Apache OFBiz: Bypass SameSite restrictions with target redirection using URL parameters (SSTI and CSRF leading to RCE)
Improper Control of Generation of Code 'Code Injection', Cross-Site Request Forgery CSRF, : Improper Neutralization of Special Elements Used in a Template Engine vulnerability in Apache OFBiz. This issue affects Apache OFBiz: before 18.12.17. Users are recommended to upgrade to version 18.12.17,...
UBUNTU-CVE-2024-52947
A cross-site scripting XSS vulnerability in LemonLDAP::NG before 2.20.1 allows remote attackers to inject arbitrary web script or HTML via the url parameter of the upgrade session confirmation page upgradeSession / forceUpgrade if the "Upgrade session" plugin has been enabled by an admin...
CVE-2024-50800
Cross Site Scripting vulnerability in M2000 Smart4Web before v.5.020241004 allows a remote attacker to execute arbitrary code via the error parameter in URL...
CVE-2024-50800
Cross Site Scripting vulnerability in M2000 Smart4Web before v.5.020241004 allows a remote attacker to execute arbitrary code via the error parameter in URL...
CVE-2024-9868
The Element Pack Elementor Addons Header Footer, Template Library, Dynamic Grid & Carousel, Remote Arrows plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the Age Gate Widget 'url' parameter in all versions up to, and including, 5.10.1 due to insufficient input sanitization a...
WordPress plugin Element Pack Elementor Addons 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2024-48346
xtreme1 = v0.9.1 contains a Server-Side Request Forgery SSRF vulnerability in the /api/data/upload path. The vulnerability is triggered through the fileUrl parameter, which allows an attacker to make arbitrary requests to internal or external systems...
CVE-2023-52066
CVE-2023-52066 affects http.zig (commit 76cf5). The issue is a CRLF injection via the url parameter, with CVSS 3.1: Network attack, no user interaction, low confidentiality/integrity impact, no availability impact; scope is changed. Exploitation status is not provided in the supplied documents; n...