CVE-2024-30250

Astro-Shield is an integration to enhance website security with SubResource Integrity hashes, Content-Security-Policy headers, and other techniques. Versions from 1.2.0 to 1.3.1 of Astro-Shield allow bypass to the allow-lists for cross-origin resources by introducing valid integrity attributes to...

CVE-2024-30248 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin...

CVE-2024-30248 Piccolo Admin's raw SVG loading may lead to complete data compromise from admin page

Piccolo Admin is an admin interface/content management system for Python, built on top of Piccolo. Piccolo's admin panel allows media files to be uploaded. As a default, SVG is an allowed file type for upload. An attacker can upload an SVG which when loaded can allow arbitrary access to the admin...

Piccolo 安全漏洞

Piccolo is a fast, user-friendly ORM and query builder from Piccolo Open Source. A security vulnerability exists in Piccolo Admin prior to version 1.3.2, which stems from the fact that Piccolo's admin panel allows uploading of media files, which can be exploited by an attacker to upload an SVG...

PT-2024-23295

Name of the Vulnerable Software and Affected Versions Piccolo Admin versions prior to 1.3.2 Description The issue concerns the Piccolo Admin interface, which allows media file uploads, including SVG files by default. An attacker can upload a malicious SVG file, which, when loaded, can provide...

PT-2024-23792 · Webdorado · Webdorado Spiderfaq

Name of the Vulnerable Software and Affected Versions: WebDorado SpiderFAQ versions 1.3.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which leads to a Cross-site Scripting XSS vulnerability. This allows for Reflected XSS attacks...

WordPress SpiderFAQ plugin <= 1.3.2 - Cross Site Scripting vulnerability

Cross Site Scripting vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin SpiderFAQ versions = 1.3.2...

CVE-2024-29906

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in realmag777 WordPress Meta Data and Taxonomies Filter MDTF allows Stored XSS.This issue affects WordPress Meta Data and Taxonomies Filter MDTF: from n/a through 1.3.2...

PT-2024-23127 · WordPress · Wordpress Meta Data/Taxonomies Filter

Name of the Vulnerable Software and Affected Versions: WordPress Meta Data and Taxonomies Filter MDTF versions 1.3.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an...

PT-2024-23156 · WordPress · Wordpress Meta Data/Taxonomies Filter

Name of the Vulnerable Software and Affected Versions: WordPress Meta Data and Taxonomies Filter MDTF versions 1.3.2 and earlier Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS. This mean...

PT-2024-22185 · Unknown · Wen Responsive Columns

Name of the Vulnerable Software and Affected Versions: WEN Responsive Columns versions 1.3.2 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting XSS. This means that an attacker can inject...

WordPress plugin Contact Form Entries Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A security vulnerability exists in the WordPress plugin...

Sql injection

Pimcore's Admin Classic Bundle provides a backend user interface for Pimcore. The application allows users to create zip files from available files on the site. In the 1.x branch prior to version 1.3.2, parameter selectedIds is susceptible to SQL Injection. Any backend user with very basic...

CVE-2024-23341

TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using tuitsehtml without quoting the input, there is a html...

Input validation

TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using tuitsehtml without quoting the input, there is a html...

PYSEC-2024-22

TuiTse-TsuSin is a package for organizing the comparative corpus of Taiwanese Chinese characters and Roman characters, and extracting sentences of the Taiwanese Chinese characters and the Roman characters. Prior to version 1.3.2, when using tuitsehtml without quoting the input, there is a html...

CVE-2024-23341

CVE-2024-23341 affects the TuiTse-TsuSin package. Before version 1.3.2, using tuitse_html without quoting the input enables a HTML injection vulnerability. A patch was released in version 1.3.2. Workarounds include sanitizing Taigi input with HTML quotation. Mitigations/impact are described in mu...

TuiTse-TsuSin Cross-Site Scripting Vulnerability

ithuan TuiTse-TsuSin is a library from the Chinese company ithuan. A cross-site scripting vulnerability exists in TuiTse-TsuSin versions prior to 1.3.2, which stems from an html injection vulnerability when using tuitsehtml without quoting input...

html injection vulnerability in the `tuitse_html` function.

Impact When using tuitsehtml without quoting the input, there is a html injection vulnerability. It should use the django version django.utils.html.formathtml, instead of string.format Patches Upgrade to version 1.3.2. Workarounds Sanitizing Taigi input with HTML quotation. References...

GHSA-M4M5-J36M-8X72 html injection vulnerability in the `tuitse_html` function.

Impact When using tuitsehtml without quoting the input, there is a html injection vulnerability. It should use the django version django.utils.html.formathtml, instead of string.format Patches Upgrade to version 1.3.2. Workarounds Sanitizing Taigi input with HTML quotation. References...