Cross site scripting

The WP Athletics WordPress plugin through 1.1.7 does not sanitise and escape a parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting...

Cross site request forgery (csrf)

The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form...

Cross site scripting

The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0626 Advanced Admin Search < 1.1.6 - Reflected Cross-Site Scripting

The Advanced Admin Search WordPress plugin before 1.1.6 does not sanitize and escape some parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting...

Cross-site Scripting (XSS)

djangojsonform is vulnerable to cross site scripting. The vulnerability exists due to a lack of sanitization of the raw JSON data of the db field in a hidden textarea tag on the admin page...

WordPress plugin WP Athletics 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress WP Athletics plugin version 1.1.7 and prior versions are vulnerable to a cross-site scripting...

WordPress plugin Advanced Admin Search 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A cross-site scripting vulnerability exists in the WordPress Advanced Admin Search plugin, which stems fr...

WordPress plugin Newsletter 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

Cross Site Scripting vulnerability in django-jsonform's admin form.

Description django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the safe template filter. This opens up possibilities for XSS attacks. This only affects the admin pages where the...

GHSA-X9JP-4W8M-4F3C Cross Site Scripting vulnerability in django-jsonform's admin form.

Description django-jsonform stores the raw JSON data of the db field in a hidden textarea on the admin page. However, that data was kept in the textarea after unescaping it using the safe template filter. This opens up possibilities for XSS attacks. This only affects the admin pages where the...

CVE-2017-20033

A vulnerability classified as problematic has been found in PHPList 3.2.6. This affects an unknown part of the file /lists/admin/. The manipulation of the argument page with the input send'";alert8 leads to cross site scripting Reflected. It is possible to initiate the attack remotely. Upgrading...

Online Ordering System SQL Injection Vulnerability (CNVD-2022-55715)

Online Ordering System is a multi-store ordering system that can be used by any small business. version 1.0 of Online Ordering System is vulnerable to a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements on the admin/editproductetails.php page,...

Elitecms SQL Injection Vulnerability (CNVD-2022-57763)

Elitecms is a Web content management by elitecms India. elitecms version 1.01 has a SQL injection vulnerability that originates from the admin/editpost.php page's lack of validation of external input SQL statements, which can be exploited by attackers to execute illegal SQL commands to steal...

Wedding Management System SQL Injection Vulnerability (CNVD-2022-54293)

Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. version 1.0 of Wedding Management System is vulnerable to SQL injection, which stems from a lack of validation of external input on the admin/usersedit.php page. SQL statement...

School Dormitory Management System Cross-Site Scripting Vulnerability (CNVD-2022-66661)

School Dormitory Management System is a school dormitory management system. v1.0 version of School Dormitory Management System has a cross-site scripting vulnerability that originates from admin/inc/navigation.php:126 page that lacks a filter for user The vulnerability is caused by a lack of...

Elitecms SQL Injection Vulnerability (CNVD-2022-57764)

Elitecms is a web content management by elitecms India. elitecms version 1.01 has a SQL injection vulnerability, which originates from the /admin/editsidebar.php page page parameter lack of validation of external input SQL statements, an attacker can use this vulnerability to execute illegal SQL...

Online Ordering System SQL Injection Vulnerability (CNVD-2022-55716)

Online Ordering System is a multi-store ordering system that can be used by any small business. version 1.0 of Online Ordering System is vulnerable to a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements on the admin/editproductimage.php page,...

Online Ordering System SQL Injection Vulnerability (CNVD-2022-55719)

Online Ordering System is a multi-store ordering system that can be used by any small business. version 1.0 of Online Ordering System is vulnerable to a SQL injection vulnerability that stems from a lack of validation of externally entered SQL statements on the admin/viewreport.php page, which...

Wedding Management System SQL Injection Vulnerability (CNVD-2022-54288)

Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. v1.0 of Wedding Management System is vulnerable to SQL injection, which originates from the admin/packageedit.php page that lacks The vulnerability is caused by a lack of validation of...

Wedding Management System SQL Injection Vulnerability (CNVD-2022-54287)

Wedding Management System is a wedding planning management system by John Paul Lim Gabule, a personal developer. v1.0 of Wedding Management System is vulnerable to SQL injection, which originates from the admin/logeventsedit.php page Lack of validation of external input SQL statements can be...