859 matches found
Improper Access Control (IDOR)
Description Improper Access Control IDOR could leak admin information. Proof of Concept 1.Login as admin, edit a role to give permission show a user information - save 2.Login as an user with that role - go to url http://my.facturascripts.site/EditUser?code=admin&action=export&option=PDF - Can se...
WordPress ShortPixel Adaptive Images plugin access control error vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress ShortPixel Adaptive Images plugin version 3.3.1 and earlier is vulnerable to an access...
CVE-2022-29417
Plugin Settings Update vulnerability in ShortPixel's ShortPixel Adaptive Images plugin = 3.3.1 at WordPress allows an attacker with a low user role like a subscriber or higher to change the plugin settings...
CVE-2022-29418
Authenticated admin user role Persistent Cross-Site Scripting XSS in Mark Daniels Night Mode plugin = 1.0.0 on WordPress via vulnerable parameters: &ntmodepagesettingenable-me, &ntmodepagesettingbg-color, &ntmodepagesettingtxt-color, &ntmodepagesettinganccolor...
CVE-2022-29418
CVE-2022-29418 affects the WordPress plugin Night Mode (Mark Daniels Night Mode) at versions
CVE-2022-29417
Summary: CVE-2022-29417 affects the WordPress ShortPixel Adaptive Images plugin (versions
CVE-2022-28438
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=User&userid=...
Sql injection
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=Admin&userid=3...
CVE-2022-28438
Baby Care System v1.0 was discovered to contain a SQL injection vulnerability via /admin/uesrs.php&action=type&userrole=User&userid=...
Cross site scripting
Authenticated admin user role Stored Cross-Site Scripting XSS in WP-Appbox WordPress plugin = 4.3.20...
CVE-2021-36893 WordPress Responsive Tabs plugin <= 4.0.5 - Cross-Site Scripting (XSS) vulnerability
Authenticated author or higher user role Stored Cross-Site Scripting XSS vulnerability in Responsive Tabs WordPress plugin = 4.0.5...
CVE-2021-36896 WordPress Pricing Table plugin <= 1.5.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated author or higher user role Stored Cross-Site Scripting XSS vulnerability in Pricing Table WordPress plugin versions = 1.5.2...
CVE-2021-36910 WordPress WP-Appbox plugin <= 4.3.20 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated admin user role Stored Cross-Site Scripting XSS in WP-Appbox WordPress plugin = 4.3.20...
PT-2022-10594
Name of the Vulnerable Software and Affected Versions Pricing Table WordPress plugin versions = 1.5.2 Description The issue is an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with at least author or higher user role can inject malicious scripts into the...
CVE-2022-27845: Improper Neutralization of Input During Web Page Generation
Authenticated admin or higher user role Stored Cross-Site Scripting XSS in PlausibleHQ Plausible Analytics WordPress plugin = 1.2.2...
CVE-2021-36910: Improper Neutralization of Input During Web Page Generation
Authenticated admin user role Stored Cross-Site Scripting XSS in WP-Appbox WordPress plugin = 4.3.20...
PT-2022-10602
Name of the Vulnerable Software and Affected Versions WP-Appbox WordPress plugin versions = 4.3.20 Description The issue is related to an Authenticated Stored Cross-Site Scripting XSS in the WP-Appbox WordPress plugin. This allows an attacker with admin user role privileges to inject malicious...
CVE-2021-36826 WordPress WP Project Manager plugin <= 2.4.13 - Stored Cross-Site Scripting (XSS) vulnerability
Authenticated subscriber or higher user role if allowed to access projects Stored Cross-Site Scripting XSS vulnerability in weDevs WP Project Manager plugin = 2.4.13 versions...
CVE-2021-36851 WordPress Testimonial Slider plugin <= 3.5.8.3 - Cross-Site Scripting (XSS) vulnerability
Authenticated editor or higher user role Cross-Site Scripting XSS vulnerability in Web-Settler Testimonial Slider – Free Testimonials Slider Plugin WordPress plugin via parameters mpsppostsbgcolor, mpsppostsdescriptioncolor, mpspslidenavbuttoncolor...
