CVE-2021-39329 JobBoardWP – Job Board Listings and Submissions <= 1.0.7 Authenticated Stored Cross-Site Scripting

The JobBoardWP WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the /includes/admin/class-metabox.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in...

Content Staging <= 2.0.1 - Admin+ Stored Cross-Site Scripting

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and escaping via several parameters that are echo’d out via the /templates/settings.php file which allowed attackers with administrative user access to inject arbitrary web scripts. This affects multi-sit...

CVE-2021-39337

The job-portal WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the /admin/jobsfunction.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions ...

CVE-2021-39344

The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the /admin/class-kjm-admin-notices-admin.php file which allowed attackers with administrative user access to inject arbitrary w...

CVE-2021-39344

The KJM Admin Notices WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the /admin/class-kjm-admin-notices-admin.php file which allowed attackers with administrative user access to inject arbitrary w...

CVE-2021-42333

The Easytest contains SQL injection vulnerabilities. After obtaining user’s privilege, remote attackers can inject SQL commands into the parameters of the learning history page to access all database and obtain administrator permissions...

Easytest SQL注入漏洞

Easytest is an online learning quiz platform of China's Hua Ju Digital Technology, Inc. Easytest is vulnerable to SQL injection, which can be exploited by attackers to inject SQL commands into the parameters of the learning history page after gaining user privileges to access all databases and ga...

Author Bio Box < 3.4.0 - Admin+ Stored Cross-Site Scripting

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the /includes/admin/class-author-bio-box-admin.php file which allowed attackers with administrative user access to inject arbitrary web scripts. This affec...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

PT-2021-22065 · Brizy +1 · Brizy +1

Name of the Vulnerable Software and Affected Versions: Brizy Page Builder plugin versions 2.3.11 and earlier Brizy versions 1.0.127 and earlier, excluding version 1.0.126 Description: The Brizy Page Builder plugin for WordPress used an incorrect authorization check, allowing any logged-in user...

Job Board Vanila <= 1.0 - Admin+ Stored Cross-Site Scripting

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the psjbexpin and the psjbcurrin parameters found in the /job-settings.php file which allowed attackers with administrative user access to inject arbitrary web scripts. This affects...

HAL < 2.2 - Admin+ Stored Cross-Site Scripting

The plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via several parameters found in the /wp-hal.php file which allowed attackers with administrative user access to inject arbitrary web scripts. This affects multi-site installations where...

Simple Online College Entrance Exam System 1.0 - (Multiple) SQL injection Vulnerability

Exploit Title: Simple Online College Entrance Exam System 1.0 - 'Multiple' SQL injection Exploit Author: Amine ismail @aminei Vendor Homepage: https://www.sourcecodester.com/php/14976/simple-online-college-entrance-exam-system-php-and-sqlite-free-source-code.html Software Link:...

CVE-2021-42086

An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request...

CVE-2021-42086

An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request...

CVE-2021-42087

An issue was discovered in Zammad before 4.1.1. An admin can discover the application secret via the API...

Cross site request forgery (csrf)

An issue was discovered in Zammad before 4.1.1. An Agent account can modify account data, and gain admin access, via a crafted request...

CVE-2021-42086

CVE-2021-42086 affects Zammad prior to 4.1.1. An Agent account can modify other account data via a crafted request and gain administrator privileges, leading to elevation of privilege. The vulnerability is described across multiple sources (NVD entry and CNVD/CNNVD/CVE records) as an account‑leve...

G Auto-Hyperlink <= 1.0.1 - Admin+ SQL Injection

The plugin does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection https://plugins.trac.wordpress.org/browser/g-auto-hyperlink/trunk/g-auto-hyperlink.phpL271 Open the...

IBM Ts7700 授权问题漏洞

The Ibm Ts7700 is a mainframe virtual tape solution from Ibm, Inc. for optimizing data security and business continuity. An authorization issue vulnerability exists in the IBM TS7700 Management Interface, which can be exploited by an attacker to gain administrative access to the Management...