CVE-2020-5843

Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen...

Design/Logic Flaw

Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen...

CVE-2020-5843

Summary: CVE-2020-5843 affects Codoforum 4.8.3 and is a cross-site scripting (XSS) vulnerability. Multiple sources (NVD entry) describe that an XSS can be triggered in the admin dashboard via the Categories on the Manage Users screen. The vulnerability is characterized as an injection/reflective ...

CVE-2020-5843

Codoforum 4.8.3 allows XSS in the admin dashboard via a category to the Manage Users screen...

Codoforum cross-site scripting vulnerability (CNVD-2020-03270)

Codoforum is a set of PHP and MySQL based forum software. A cross-site scripting vulnerability exists in the admin dashboard in Codoforum version 4.8.3. The vulnerability stems from a lack of proper validation of client-side data by the WEB application. An attacker can exploit the vulnerability t...

CVE-2020-5305

Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen...

CVE-2020-5305

Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen...

Design/Logic Flaw

Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen...

CVE-2020-5305

Codoforum 4.8.3 allows XSS in the admin dashboard via a name field of a new user, i.e., on the Manage Users screen...

CVE-2020-5305

CVE-2020-5305 affects Codoforum 4.8.3, exposing a cross‑site scripting (XSS) vulnerability in the admin dashboard via the name field when creating a new user on the Manage Users screen. Public sources consistently describe the issue as a lack of proper validation of client‑side data, enabling inj...

CVE-2019-19980

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a privilege bypass flaw that allowed authenticated users Subscriber or greater access to send test emails from the administrative dashboard on behalf of an administrator. This occurs because the plugin registers a wpajax...

WordPress Email Subscribers & Newsletters Elevation of Privilege Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An elevation of privilege vulnerability exis...

gitea -- multiple vulnerabilities

The Gitea Team reports for release 1.11.0: Never allow an empty password to validate 9682 9683 Prevent redirect to Host 9678 9679 Swagger hide search field 9554 Add "search" to reserved usernames 9063 Switch to fomantic-ui 9374 Only serve attachments when linked to issue/release and if accessible...

CVE-2019-8152

A stored cross-site scripting XSS vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective function and inject malicious javascript ...

CVE-2019-8152

A stored cross-site scripting XSS vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective function and inject malicious javascript ...

Cross site scripting

A stored cross-site scripting XSS vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective function and inject malicious javascript ...

CVE-2019-8152

A stored cross-site scripting XSS vulnerability exists in in Magento 1 prior to 1.9.4.3 and 1.14.4.3, Magento 2.2 prior to 2.2.10, Magento 2.3 prior to 2.3.3 or 2.3.2-p1. An authenticated user with access to the wysiwyg editor can abuse the blockDirective function and inject malicious javascript ...

CVE-2019-8152

Magento 1: stored XSS via wysiwyg blockDirective() in admin cache affects 1.x before 1.9.4.3 and 1.14.4.3; Magento 2: affected if below 2.2.10 (2.2) or below 2.3.3 (2.3) or 2.3.2-p1. Authenticated user with wysiwyg editor access can inject JavaScript into the admin dashboard cache. Mitigation/pat...

Zomato: [www.zomato.com] Blind XSS on one of the Admin Dashboard

Thanks for the report @pandaaaa. The Blind XSS fired when the order details were viewed by the admin at the back-end, The script was injected through an API endpoint from the Zomato app on one of the parameters which was recently introduced to provide special instructions to the restaurant on how...

CVE-2019-16931

A stored XSS vulnerability in the Visualizer plugin 3.3.0 for WordPress allows an unauthenticated attacker to execute arbitrary JavaScript when an admin or other privileged user edits the chart via the admin dashboard. This occurs because classes/Visualizer/Gutenberg/Block.php registers...