2398 matches found
CVE-2022-37247
Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting XSS via /admin/settings/fields page...
CVE-2022-2655
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...
Cross site scripting
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...
CVE-2022-2655 Classified Listing Pro < 2.0.20 - Reflected Cross-Site Scripting
The Classified Listing Pro WordPress plugin before 2.0.20 does not escape a generated URL before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting...
WordPress plugin Classified Listing Pro 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in...
Church Management System SQL注入漏洞
Church Management System is a church management system. A security vulnerability exists in Church Management System v1.0, which was discovered to contain a SQL injection vulnerability via the id parameter in /admin/edituser.php...
TaskBuilder < 1.0.8 - Subscriber+ Stored XSS via SVG file upload
The plugin does not validate and sanitise task's attachments, which could allow any authenticated user such as subscriber creating a task to perform Stored Cross-Site Scripting by attaching a malicious SVG file Create a SVG with the following content: alertdocument.cookie; As any authenticated...
CVE-2022-37796
In Simple Online Book Store System 1.0 in /adminbook.php the Title, Author, and Description parameters are vulnerable to Cross Site ScriptingXSS...
Sql injection
JFinal CMS 5.1.0 is vulnerable to SQL Injection via /admin/videoalbum/list...
JFinal SQL注入漏洞
JFinal is a Java-based WEB + ORM open source framework. JFinal CMS version 5.1.0 has a security vulnerability , the vulnerability stems from /admin/friendlylink/list SQL injection vulnerability...
CVE-2022-2540
The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 1.4.5. This is due to missing nonce validation on the adminpage function found in the /admin.php file. This makes it possible for unauthenticated...
CVE-2022-2540
The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 1.4.5. This is due to missing nonce validation on the adminpage function found in the /admin.php file. This makes it possible for unauthenticated...
CVE-2022-2540
The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 1.4.5. This is due to missing nonce validation on the adminpage function found in the /admin.php file. This makes it possible for unauthenticated...
Cross site request forgery (csrf)
The Link Optimizer Lite plugin for WordPress is vulnerable to Cross-Site Request Forgery to Cross-Site Scripting in versions up to, and including 1.4.5. This is due to missing nonce validation on the adminpage function found in the /admin.php file. This makes it possible for unauthenticated...
PT-2022-17263 · WordPress · Link Optimizer Lite
Name of the Vulnerable Software and Affected Versions: Link Optimizer Lite plugin for WordPress versions up to, and including 1.4.5 Description: The issue is due to missing nonce validation on the admin page function found in the admin.php file. This allows unauthenticated attackers to modify the...
WordPress plugin Link Optimizer Lite 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...
U.S. Dept Of Defense: Authentication bypass leads to Information Disclosure at U.S Air Force "https://███"
Hi Hackerone Triage team, I'm new in this program, what i understood that every Web Owned/Operated by DoD is in scope , so i did some google searches , exactly in wikipedia and i've find this PNG that confirms that U.S Air Force is in scope :...
CVE-2022-36735
Library Management System v1.0 was discovered to contain a SQL injection vulnerability via the bookId parameter at /admin/delete.php...