PT-2024-12109 · Unknown · Cs-Cart Multivendor

Name of the Vulnerable Software and Affected Versions: CS-Cart MultiVendor version 4.16.1 Description: A Cross Site Scripting XSS issue allows remote attackers to run arbitrary code via the product data parameter of add/edit product in the administration interface. This enables attackers to execu...

CVE-2021-22967: Authorization Bypass Through User-Controlled Key

In Concrete CMS formerly concrete 5 below 8.5.7, IDOR Allows Unauthenticated User to Access Restricted Files If Allowed to Add Message to a Conversation.To remediate this, a check was added to verify a user has permissions to view files before attaching the files to a message in "add / edit...

uListing < 2.0.6 - Multiple CSRF

The plugin is lacking proper CSRF checks in multiple protected actions within wp-admin pages, leaving them vulnerable to CSRF attacks. PoC | CSRF | Add/Edit Pricing Plans: POST /wp-admin/admin-ajax.php HTTP/2 Host: example.com Cookie: agent or admin cookies User-Agent: Mozilla/5.0 Content-Type:...

Mapplic and Mapplic Lite - SSRF to Stored Cross-Site Scripting (XSS)

The Mapplic Lite alert/XSS/...

CVE-2020-13474

In NCH Express Accounts 8.24 and earlier, an authenticated low-privilege user can enter a crafted URL to access higher-privileged functionalities such as Add/Edit users...

CVE-2020-8520

SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

Sql injection

SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

Sql injection

SQL injection with start and length parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8519: Improper Neutralization of Special Elements used in an SQL Command

SQL injection with the search parameter in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

CVE-2020-8520: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in order and column parameters in Records.php for phpzag live add edit delete data tables records with ajax php mysql...

WordPress wp-google-map-plugin plugin cross-site request forgery vulnerability (CNVD-2019-28881)

WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. wp-google-map-plugin plugin is a Google Maps plugin used in it. A cross-site request forgery vulnerability exists in th...

Cross site request forgery (csrf)

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature...

CVE-2015-9307

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature...

CVE-2015-9307: Cross-Site Request Forgery (CSRF)

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit location feature...

CVE-2015-9308: Cross-Site Request Forgery (CSRF)

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit map feature...

CVE-2015-9309: Cross-Site Request Forgery (CSRF)

The wp-google-map-plugin plugin before 2.3.10 for WordPress has CSRF in the add/edit category feature...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 is affected by a cross-site scripting vulnerability. The issue arises in the Add/Edit Widget functionality where a crafted value in the Caption field can impact setDashboardWidget in CommonDataHandlerReadOnly.ashx, indicating insufficient input validation/encoding in...

CVE-2019-14297

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...

CVE-2019-14297: Improper Neutralization of Input During Web Page Generation

Veeam ONE Reporter 9.5.0.3201 allows XSS via the Add/Edit Widget with a crafted Caption field to setDashboardWidget in CommonDataHandlerReadOnly.ashx...