7125 matches found
CVE-2024-9892
The Add Widget After Content plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.4.6 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...
CVE-2024-51380
Stored Cross-Site Scripting XSS vulnerability discovered in the Properties Component of JATOS v3.9.3. This flaw allows an attacker to inject malicious JavaScript into the properties section of a study, specifically within the UUID field. When an admin user accesses the study's properties, the...
CVE-2024-32371
An issue in HSC Cybersecurity HC Mailinspector 5.2.17-3 through 5.2.18 allows a regular user account to escalate their privileges and gain administrative access by changing the type parameter from 1 to 0...
CVE-2024-4447
In the System → Maintenance tool, the Logged Users tab surfaces sessionId data for all users via the Direct Web Remoting API UserSessionAjax.getSessionList.dwr calls. While this is information that would and should be available to admins who possess "Sign In As" powers, admins who otherwise lack...
CVE-2024-13056
The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-53282
Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in WiFi Connect MAC Filter functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing...
CVE-2024-9828
The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'loadorders' parameter and uses it in a SQL statement, allowing high privilege users such as admin to perform SQL Injection attacks...
CVE-2024-54682
Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin...
CVE-2023-25477
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Yotuwp Video Gallery plugin = 1.3.12 versions...
CVE-2023-30746
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Booqable Rental Software Booqable Rental plugin = 2.4.15 versions...
CVE-2023-28690
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Steinbrecher WP BrowserUpdate plugin = 4.5 versions...
CVE-2023-26541
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Alexander Suess asMember plugin = 1.5.4 versions...
CVE-2023-41737
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPGens Swifty Bar, sticky bar by WPGens plugin = 1.2.10 versions...
CVE-2023-25702
Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Fullworks Quick Paypal Payments plugin = 5.7.25 versions...
CVE-2023-25979
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Video Gallery by Total-Soft Video Gallery plugin = 1.7.6 versions...
CVE-2023-25490
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.4 versions...
CVE-2023-25460
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in CodeSolz Easy Ad Manager plugin = 1.0.0 versions...
CVE-2023-25963
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in JoomSky JS Job Manager plugin = 2.0.0 versions...