CVE-2023-32725

The CVE-2023-32725 issue affects the Zabbix frontend URL widget: testing or running scheduled reports can cause the site to receive a session cookie that can be used to access the frontend as the specific user. Root cause is improper handling of session cookies in the URL widget, enabling session...

PT-2023-7982 · Zabbix +4 · Zabbix +4

Name of the Vulnerable Software and Affected Versions: Zabbix versions affected versions not specified Description: The issue is related to the incorrect handling of security prefixes in cookie names, specifically the zbx session cookie, which can allow a remote attacker to elevate their...

CVE-2023-49150

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CurrencyRate.Today Crypto Converter Widget allows Stored XSS.This issue affects Crypto Converter Widget: from n/a through 1.8.1...

CVE-2023-49150

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CurrencyRate.Today Crypto Converter Widget allows Stored XSS.This issue affects Crypto Converter Widget: from n/a through 1.8.1...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CurrencyRate.Today Crypto Converter Widget allows Stored XSS.This issue affects Crypto Converter Widget: from n/a through 1.8.1...

CVE-2023-49150 WordPress Crypto Converter Widget Plugin <= 1.8.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in CurrencyRate.Today Crypto Converter Widget allows Stored XSS.This issue affects Crypto Converter Widget: from n/a through 1.8.1...

CVE-2023-49150

CVE-2023-49150: CurrencyRate.Today Crypto Converter Widget WordPress plugin suffers stored XSS due to improper input neutralization during web page generation. Affected versions: up to 1.8.1 (plugin). Root cause per sources: improper neutralization of input; impact is stored XSS in pages using th...

WP Crowdfunding < 2.1.9 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin 1. Add a "Campaign Search" widget to your site via Appearance Customise Widgets for...

WordPress plugin and WordPress cross-site scripting vulnerabilities

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

WP Crowdfunding < 2.1.9 - Reflected XSS

Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC 1. Add a "Campaign Search" widget to your site via Appearance Customise Widgets for...

WordPress ArtPlacer Widget Plugin <= 2.20.6 is vulnerable to SQL Injection

Software ArtPlacer Widget Type Plugin Vulnerable versions = 2.20.6 Fixed in 2.20.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-6373 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 85dfadf12e68 Credits Claudio Marchesini Enrico Marcolini Required...

Crypto Converter Widget < 1.8.4 - Contributor+ Stored XSS

Description The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

ArtPlacer Widget < 2.20.7 - Editor+ SQLi

Description The plugin does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor or above PoC As an editor, open...

ArtPlacer Widget < 2.20.7 - Editor+ SQLi

Description The plugin does not sanitize and escape the "id" parameter before submitting the query, leading to a SQLI exploitable by editors and above. Note: Due to the lack of CSRF check, the issue could also be exploited via a CSRF against a logged editor or above As an editor, open...

Enhanced Text Widget <= 1.6.2 - Missing Authorization via etw_hide_admin_notification_callback

Description The Enhanced Text Widget plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the etwhideadminnotificationcallback function in versions up to, and including, 1.6.2. This makes it possible for unauthenticated attackers to hide adm...

@bbc/timeline-state-resolver-tools (>=9.4.0-nightly-release53-6a8a2347-20250820-110110.0, <=10.0.0-nightly-release53-982ec310-20251124-232913.0), @bitrefill/airfill-widget (>=4.2.2, <=4.8.3) +159 more potentially affected by CVE-2024-21528 via node-gettext (>=0.1.2, <=3.0.1)

node-gettext NPM version =0.1.2, =9.4.0-nightly-release53-6a8a2347-20250820-110110.0, =4.2.2, =2.2.0, =2.2.0, =0.9.1, =1.1.2, =4.1.0-alpha.1, =0.0.4, =5.2.0-alpha.13, =5.2.0-alpha.18, =1.0.6, =1.0.17, =1.0.3, =4.1.2, =4.1.4 and more Source cves: CVE-2024-21528 Source advisory:...

CVE-2023-42573

PendingIntent hijacking vulnerability in Search Widget prior to version 3.4 in China models allows local attackers to access data...

CVE-2023-42573

PendingIntent hijacking vulnerability in Search Widget prior to version 3.4 in China models allows local attackers to access data...

Spoofing

PendingIntent hijacking vulnerability in Search Widget prior to version 3.4 in China models allows local attackers to access data...

CVE-2023-42573

CVE-2023-42573 describes a PendingIntent hijacking vulnerability in the Search Widget on Samsung devices, affecting China models prior to version 3.4 . The underlying flaw allows local attackers to access data through hijacked PendingIntents. Connected sources specify that vulnerable versions are...