9108 matches found
CVE-2026-114624
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...
EUVD-2026-108995
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...
CVE-2026-114624 baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...
CVE-2026-114624
The baserCMS website development framework (versions 5.0.0 to 5.3.2 and 5.4.0 to 5.4.2 ) is vulnerable to PHP object injection . The widget-area entity fails to validate input types, allowing a string submitted via the admin JSON API to be stored unchanged. Subsequent entity reads deserialize thi...
CVE-2026-114624 baserCMS: PHP object injection via unguarded unserialize() in the widget-area entity
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...
PT-2026-122103
baserCMS is a website development framework. In versions 5.0.0 before 5.3.2 and 5.4.0 before 5.4.2, the widget-area entity serializes widgets only when the submitted value is an array, allowing a string submitted through the admin JSON API to be stored unchanged. Entity reads, including front-end...
CVE-2017-20289
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...
CVE-2017-20289 Broadstreet Ad Widget WordPress Plugin < 2.12.0 Local File Inclusion via step parameter
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...
CVE-2017-20289
The Broadstreet Ad Widget plugin for WordPress (versions 2.2.0 before 2.12.0 ) contains a local file inclusion vulnerability. The root cause is the passing of unsanitized input to a require statement in views/modal/index.php. Authenticated users can execute attacker-chosen PHP files by supplying ...
EUVD-2017-19026
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...
ApostropheCMS: Stored XSS Via Unescaped Widget Style Attribute Serialization
Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form "string" style field with a CSS "property" and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...
VulnCheck KEV: CVE-2017-20289
Broadstreet Ad Widget plugin for WordPress 2.2.0 before 2.12.0 contains a local file inclusion vulnerability that allows authenticated users to execute attacker-chosen PHP files by passing unsanitized input to require in views/modal/index.php. Attackers can supply directory traversal sequences in...
EUVD-2026-105171
ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization...
GHSA-7JG5-FRGC-C67W ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...
ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
Summary ApostropheCMS widget styles support project-defined schema fields. If a project defines a free-form string style field with a CSS property and no selector, an editor-controlled value is rendered as an inline CSS declaration. The resulting declaration is then inserted into the widget...
npm: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization
npm: ApostropheCMS: Stored XSS via Unescaped Widget Style Attribute Serialization vulnerability discovered by ? in WordPress npm apostrophe versions 4.34.0...
WordPress Click n Chat (Chat Widget Integration) plugin 1.0.4-1.1.2 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Erwan LR WPScan in WordPress Plugin Click n Chat Chat Widget Integration versions 1.0.4-1.1.2...
WordPress Click n Chat (Chat Widget Integration) plugin < 1.1.3 - Unauthenticated SQLi vulnerability
Unauthenticated SQLi vulnerability discovered by Ryan Fabella in WordPress Plugin Click n Chat Chat Widget Integration versions 1.1.3...
CVE-2026-92997
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not properly validate a parameter before using it as a column identifier in a SQL query, allowing unauthenticated attackers to perform SQL injection attacks...
CVE-2026-92998
The Click n Chat Chat Widget Integration WordPress plugin before 1.1.3 does not sanitise sort parameters before using them in a SQL ORDER BY clause, allowing unauthenticated attackers to perform SQL injection attacks...