6706 matches found
CVE-2023-32498
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Easy Form team Easy Form by AYS plugin = 1.2.0 versions...
FTP Access <= 1.0 - Subscriber+ Stored XSS
Description The plugin does not have authorisation and CSRF checks when updating its settings and is missing sanitisation as well as escaping in them, allowing any authenticated users, such as subscriber to update them with XSS payloads, which will be triggered when an admin will view the setting...
CVE-2023-31232
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in David Artiss Plugins List plugin = 2.5 versions...
CVE-2023-28690
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Steinbrecher WP BrowserUpdate plugin = 4.5 versions...
CVE-2023-31091
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Pradeep Singh Dynamically Register Sidebars plugin = 1.0.1 versions...
CVE-2023-3266
A non-feature complete authentication mechanism exists in the production application allowing an attacker to bypass all authentication checks if LDAP authentication is selected.An unauthenticated attacker can leverage this vulnerability to log in to the CypberPower PowerPanel Enterprise as an...
PT-2023-22954 · WordPress · Icontrolwp Article Directory Redux
Name of the Vulnerable Software and Affected Versions: iControlWP Article Directory Redux plugin versions 1.0.2 and earlier Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin access can inject malicious scrip...
Advanced File Manager < 5.1.1 - Admin+ Arbitrary File/Folder Access
Description The plugin does not adequately authorize its usage on multisite installations, allowing site admin users to list and read arbitrary files and folders on the server. On a multisite installation, log in as a site admin. Notice that you are able to manage files on the server using this...
Design/Logic Flaw
A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action...
CVE-2023-35179 2FA/MFA Bypass Vulnerability in Serv-U 15.4
A vulnerability has been identified within Serv-U 15.4 that, if exploited, allows an actor to bypass multi-factor/two-factor authentication. The actor must have administrator-level access to Serv-U to perform this action...
CVE-2023-37388
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Sudipto Pratap Mahato Simple Light Weight Social Share plugin = 2.0 versions...
CVE-2023-36530
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Smartypants SP Project & Document Manager plugin = 4.67 versions...
CVE-2023-23871
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Webdzier Button plugin = 1.1.23 versions...
CVE-2022-44629
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Catalyst Connect Catalyst Connect Zoho CRM Client Portal plugin = 2.0.0 versions...
PT-2023-25189 · Serv-U · Serv-U
Name of the Vulnerable Software and Affected Versions: Serv-U version 15.4 Description: A vulnerability has been identified that allows an actor to bypass multi-factor or two-factor authentication. The actor must have administrator-level access to perform this action. Recommendations: For Serv-U...
PT-2023-25940 · WordPress · Sudipto Pratap Mahato Simple Light Weight Social Share
Name of the Vulnerable Software and Affected Versions: Sudipto Pratap Mahato Simple Light Weight Social Share plugin versions = 2.0 Description: The issue is related to an Authenticated Stored Cross-Site Scripting XSS vulnerability. This means that an attacker with admin+ privileges can inject...
Stored Cross-Site Scripting (XSS) in Threat Intelligence rules in Guardian/CMC before 22.6.2
Summary An authenticated attacker with administrative access to the web management interface can inject malicious JavaScript code inside the definition of a Threat Intelligence rule, that will be stored and can later be executed by another legitimate user viewing the details of such a rule. Impac...
CVE-2023-25984
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Rigorous & Factory Pattern Dovetail plugin = 1.2.13 versions...