PT-2022-16047 · WordPress · Post Smtp Mailer/Email Log

Name of the Vulnerable Software and Affected Versions: Post SMTP Mailer/Email Log WordPress plugin versions prior to 2.1.7 Description: The issue concerns a lack of proper authorization in some AJAX actions within the plugin, potentially allowing high-privilege users, such as administrators, to...

CVE-2022-37342

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability Add Shortcodes Actions And Filters plugin = 2.0.9 at WordPress...

Cross site scripting

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability Add Shortcodes Actions And Filters plugin = 2.0.9 at WordPress...

CVE-2022-37342 WordPress Add Shortcodes Actions And Filters plugin <= 2.0.9 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability Add Shortcodes Actions And Filters plugin = 2.0.9 at WordPress...

Privilege Escalation

github.com/grafana/grafana is vulnerable to cross-site scripting. The vulnerability exists in multiple functions of dashboardpermissions.go because viewer and editor permissions to dashboards and folders are not properly controlled with admin permissions which allows an attacker to gain access an...

Potential Impossibility in Creating claims Batch

Lines of code Vulnerability details Overview The createClaimsBatch function of the VTVLVesting contract allows for creation of claims in batch with an unbounded amount of actions. Specifically, the function does not impose a hard cap on the number of elements in the arrays passed as parameters...

WordPress plugin Rate my Post – WP Rating System 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. Cross-site request forgery...

WordPress plugin Backup Scheduler 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

Backup Scheduler <= 1.5.13 - Cross-Site Request Forgery

The plugin does not have CSRF check in some places, which could allow attackers to make logged in users perform unwanted actions...

WordPress plugin Add Shortcodes Actions And Filters 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

PT-2022-25287 · Tabs · Tabs

Name of the Vulnerable Software and Affected Versions: Tabs plugin versions 3.7.1 and earlier Description: The issue concerns multiple authenticated stored Cross-Site Scripting XSS vulnerabilities. This means that an attacker can inject malicious scripts into the website, which will be executed b...

Rdiffweb 授权问题漏洞

Rdiffweb is a web application by Patrik Dufresne, an individual developer in the USA. Provides quick access to your archives through an efficient web interface. An authorization issue vulnerability exists in Rdiffweb versions prior to 2.4.7, which can be exploited by an attacker to steal cookies...

WordPress plugin SEO Redirection 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2022-3255

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify...

CVE-2022-3255 Cross-site Scripting (XSS) - Reflected in pimcore/pimcore

If an attacker can control a script that is executed in the victim's browser, then they can typically fully compromise that user. Amongst other things, the attacker can: Perform any action within the application that the user can perform. View any information that the user is able to view. Modify...

CVE-2022-23685

A vulnerability in the ClearPass Policy Manager web-based management interface exists which exposes some endpoints to a lack of Cross-Site Request Forgery CSRF protection. This could allow a remote unauthenticated attacker to execute arbitrary input against these endpoints if the attacker can...

CVE-2022-2840

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections...

CVE-2022-2958

The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections...

CVE-2022-2840

The Zephyr Project Manager WordPress plugin before 3.2.5 does not sanitise and escape various parameters before using them in SQL statements via various AJAX actions available to both unauthenticated and authenticated users, leading to SQL injections...

Sql injection

The BadgeOS WordPress plugin before 3.7.1.3 does not sanitise and escape parameters before using them in SQL statements via AJAX actions available to any authenticated users, leading to SQL Injections...