PT-2018-13446

Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for XSS via the tags parameter in the "mc-admin/post-edit.php" endpoint. Recommendations For MiniCMS version 1.10, avoid using the tags parameter in the "mc-admin/post-edit.php" endpoint until...

CVE-2018-10424

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

CVE-2018-10424: Exposure of Sensitive Information to an Unauthorized Actor

mc-admin/post-edit.php in MiniCMS 1.10 allows full path disclosure via a modified id field...

PT-2018-9877

Name of the Vulnerable Software and Affected Versions: MiniCMS version 1.10 Description: The issue in MiniCMS allows for full path disclosure through a modified id field in the mc-admin/post-edit.php file. Recommendations: For MiniCMS version 1.10, update the mc-admin/post-edit.php file to proper...

CVE-2018-10296

MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter...

CVE-2018-10296: Improper Neutralization of Input During Web Page Generation

MiniCMS V1.10 has XSS via the mc-admin/post-edit.php title parameter...

PT-2018-9806

Name of the Vulnerable Software and Affected Versions: MiniCMS version 1.10 Description: The issue allows for XSS via the title parameter in the "mc-admin/post-edit.php" API endpoint. Recommendations: For MiniCMS version 1.10, avoid using the title parameter in the "mc-admin/post-edit.php" endpoi...

CVE-2018-5312

The tabs-responsive plugin 1.8.0 for WordPress has XSS via the posttitle parameter to wp-admin/post.php...

CVE-2017-16230

In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-edit...

PT-2017-3109

Name of the Vulnerable Software and Affected Versions libmtk MediaTek SDK versions affected versions not specified Description The issue is related to weaknesses in the authentication procedure of the http module for libmtk, which is used in WiMAX routers based on the MediaTek SDK. This allows a...

CVE-2012-6692: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/wp-seo-metabox.js in the WordPress SEO by Yoast plugin before 2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the posttitle parameter to wp-admin/post-new.php, which is not properly handled in the snippet preview...

PT-2015-3538

Name of the Vulnerable Software and Affected Versions WordPress SEO by Yoast plugin versions prior to 2.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the post title parameter to "wp-admin/post-new.php". This is due to...

CVE-2015-4065

Summary (CVE-2015-4065) : The WordPress Landing Pages plugin (versions before 1.8.5) contains an XSS vulnerability in shared/shortcodes/inbound-shortcodes.php. An authenticated remote user can inject arbitrary script/HTML via the post parameter passed to wp-admin/post-new.php, caused by echoing u...

CVE-2015-4065

Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php...

CVE-2015-4065: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php...

PT-2015-6406

Name of the Vulnerable Software and Affected Versions Landing Pages plugin versions prior to 1.8.5 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML. The injection can be done v...

VulnCheck KEV: CVE-2015-1494

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting XSS attacks via an mfbfw parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfwpadding parameter and...