2836 matches found
Views for WPForms < 3.2.3 - Missing Authorization via create_view
Description The Views for WPForms – Display & Edit WPForms Entries on your site frontend plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'createview' function in all versions up to, and including, 3.2.2. This makes it possible for...
Post views Stats <= 1.3 - Reflected Cross-Site Scripting via from and to
Description The Post views Stats plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'from’ and 'to' parameters in versions up to, and including, 1.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...
WordPress Post views Stats Plugin <= 1.3 is vulnerable to Cross Site Scripting (XSS)
Software Post views Stats Type Plugin Vulnerable versions = 1.3 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-22289 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 3725fdc02a73 Credits Dimas Maulana Required privilege...
Cross-site Scripting (XSS)
Overview github.com/gofiber/template/v2/django/v2 is a template engine create by flosch. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Views interface due to improper input validation. An attacker can execute malicious scripts in users' browsers when visitin...
CVE-2024-22199
This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious...
CVE-2024-22199: Improper Input Validation
This package provides universal methods to use multiple template engines with the Fiber web framework using the Views interface. This vulnerability specifically impacts web applications that render user-supplied data through this template engine, potentially leading to the execution of malicious...
GHSA-75MC-3PJC-727Q Unauthenticated db-file-storage views
Impact In Nautobot 1.x and 2.0.x, the URLs /files/get/?name=... and /files/download/?name=... are used to provide admin access to files that have been uploaded as part of a run request for a Job that has FileVar inputs. Under normal operation these files are ephemeral and are deleted once the Job...
[20240201] - Core - Insufficient session expiration in MFA management views
The MFA management features did not properly terminate existing user sessions when a user's MFA methods have been modified...
PT-2023-30320
Name of the Vulnerable Software and Affected Versions Label Studio versions prior to 1.9.2post0 Description The vulnerability allows attackers to construct a filter chain and exploit Django's Object Relational Mapper ORM to leak sensitive fields, including account password hashes, character by...
CVE-2023-40123
In updateActionViews of PipMenuView.java, there is a possible bypass of a multi user security boundary due to a confused deputy. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation...
Open Redirect
djangograppelli is vulnerable to Open Redirect. The library attempts to prevent external redirection with startswith/ but this does not include protocol-relative URL attacks e.g., //example.com, which allows a remote attacker to gain confidential information via views/switch.py...
Xxe
views/switch.py in django-grappelli aka Django Grappelli before 2.15.2 attempts to prevent external redirection with startswith"/" but this does not consider a protocol-relative URL e.g., //example.com attack...
PYSEC-2023-211
views/switch.py in django-grappelli aka Django Grappelli before 2.15.2 attempts to prevent external redirection with startswith"/" but this does not consider a protocol-relative URL e.g., //example.com attack...
CVE-2021-46898
views/switch.py in django-grappelli aka Django Grappelli before 2.15.2 attempts to prevent external redirection with startswith"/" but this does not consider a protocol-relative URL e.g., //example.com attack...
CVE-2021-46898: URL Redirection to Untrusted Site
views/switch.py in django-grappelli aka Django Grappelli before 2.15.2 attempts to prevent external redirection with startswith"/" but this does not consider a protocol-relative URL e.g., //example.com attack...
Oracle Database Server Security Vulnerability
Oracle Database Server is a set of relational database management system of the United States Oracle Oracle. The database management system provides data management, distributed processing, and other functions. A security vulnerability in the Oracle Database Sharding component of Oracle Database...
PT-2023-10301 · WordPress · Most Popular Posts Widget Plugin
Name of the Vulnerable Software and Affected Versions: Most Popular Posts Widget Plugin versions up to 0.8 Description: A critical issue has been found in the Most Popular Posts Widget Plugin, affecting the add views/show views function of the functions.php file. This issue leads to sql injection...
SUSE CVE-2023-39510
Cacti is an open source operational monitoring and fault management framework. Affected versions are subject to a Stored Cross-Site-Scripting XSS Vulnerability allows an authenticated user to poison data stored in the cacti's database. These data will be viewed by administrative cacti accounts an...
Cross-site Request Forgery (CSRF)
org.jenkins-ci.plugins, favorite-view is vulnerable to Cross-Site Request Forgery. The vulnerability exists due to the lack of validation in the HTTP endpoint which allows an attackers to add or remove views from another user's favorite views tab bar...