301 matches found
CVE-2021-21425: Improper Access Control
Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify pages. In versions 1.10.7 and earlier, an unauthenticated user can execute some methods of administrator controller without needing any credentials. Particular method execution will result in...
PT-2021-14497 · Grav · Grav Admin Plugin
Name of the Vulnerable Software and Affected Versions: Grav Admin Plugin versions 1.10.7 and earlier Description: The issue allows an unauthenticated user to execute certain methods of the administrator controller without credentials, resulting in arbitrary YAML file creation or modification. Thi...
GravCMS Remote Command Execution
This module exploits arbitrary config write/update vulnerability to achieve remote code execution. Unauthenticated users can execute a terminal command under the context of the web server user. Grav Admin Plugin is an HTML user interface that provides a way to configure Grav and create and modify...
Grav CMS 1.6.30 Cross Site Scripting
Exploit Title: Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting Date: 13-12-2020 Exploit Author: Sagar Banwa Vendor Homepage: https://getgrav.org/ Software Link: https://getgrav.org/downloads Version: Grav v1.6.30 - Admin v1.9.18 Tested on: Windows 10/Kali Linux...
Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting
Exploit Title: Grav CMS 1.6.30 Admin Plugin 1.9.18 - 'Page Title' Persistent Cross-Site Scripting Date: 13-12-2020 Exploit Author: Sagar Banwa Vendor Homepage: https://getgrav.org/ Software Link: https://getgrav.org/downloads Version: Grav v1.6.30 - Admin v1.9.18 Tested on: Windows 10/Kali Linux...
Cross-Site Scripting (XSS)
getgrav/grav is vulnerable to cross-site scripting XSS. A user with the ability to edit pages is able to inject and execute malicious code due to insecure default security configuration when using Admin plugin to edit pages...
SSRF when adding Jira server in admin plugin
h2. Please be aware that Atlassian does not consider this issue to represent a security risk as the functionality is restricted to users with administrative rights. h3. Issue Summary When adding a Jira server in Bamboo under the "User directories" module, an attacker can put any value in the...
SSRF when adding Jira server in admin plugin
h2. Please be aware that Atlassian does not consider this issue to represent a security risk as the functionality is restricted to users with administrative rights. h3. Issue Summary When adding a Jira server in Bamboo under the "User directories" module, an attacker can put any value in the...
hexo-admin plugin for Node.js cross-site scripting vulnerability
hexo-admin plugin for Node.js is a backend administration plugin for use in Node.js. A cross-site scripting vulnerability exists in the Post editor feature in hexo-admin plugin for Node.js version 2.3.0 and earlier, which stems from the lack of proper validation of client-side data in a web...
CVE-2019-17606
The Post editor functionality in the hexo-admin plugin versions 2.3.0 and earlier for Node.js is vulnerable to stored XSS via the content of a post...
CVE-2019-17606
CVE-2019-17606 : The hexo-admin plugin for Node.js (versions ≤ 2.3.0) is vulnerable to stored cross-site scripting via the content of a post in the Post editor. The root cause is lack of proper validation/escaping of user-supplied content, allowing an attacker to inject arbitrary JavaScript that ...
CVE-2017-18520
The democracy-poll plugin before 5.4 for WordPress has XSS via updatel10n in admin/class.DemAdminInit.php...
CVE-2018-20971
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan...
Cross site request forgery (csrf)
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan...
CVE-2018-20971
The church-admin plugin before 1.2550 for WordPress has CSRF affecting the upload of a bible reading plan...
CVE-2018-18824: Improper Neutralization of Input During Web Page Generation
WolfCMS v0.8.3.1 allows XSS via an SVG file to /?/admin/plugin/filemanager/browse/...
CVE-2018-20775: Improper Control of Generation of Code
admin/?/plugin/filemanager in Frog CMS 0.9.5 allows PHP code execution by creating a new .php file containing PHP code, and then visiting this file under the public/ URI...
PT-2019-10221
Name of the Vulnerable Software and Affected Versions: Frog CMS version 0.9.5 Description: The issue allows for XSS by creating a new file containing a crafted attribute of an IMG element, specifically targeting the "admin/?/plugin/file manager" endpoint. Recommendations: For Frog CMS version...
WordPress Absolutely Glamorous Custom Admin Plugin <= 6.4.1 Database Backup Arbitrary File Download Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2018 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112439";...