162 matches found
GHSA-W54X-R83C-X79Q Pepr Has Overly Permissive RBAC ClusterRole in Admin Mode
Severity: LOW Target: /workspace/pepr/src/lib/assets/rbac.ts Endpoint: Kubernetes RBAC configuration Method: Deployment Response / Rationale Pepr defaults to rbacMode: "admin" because the initial experience is designed to be frictionless for new users. This mode ensures that users can deploy and...
CVE-2021-41764
A cross-site request forgery CSRF vulnerability exists in Streama up to and including v1.10.3. The application does not have CSRF checks in place when performing actions such as uploading local files. As a result, attackers could make a logged-in administrator upload arbitrary local files via a...
Bagisto has HTML Filter Bypass that Enables Stored XSS
Summary A stored Cross-Site Scripting XSS vulnerability exists in Bagisto 2.3.8 within the CMS page editor. Although the platform normally attempts to sanitize tags, the filtering can be bypassed by manipulating the raw HTTP POST request before submission. As a result, arbitrary JavaScript can be...
CVE-2025-13456
CVE-2025-13456 concerns the ShopBuilder WordPress plugin prior to 3.2.2. The vulnerability is a reflected XSS caused by insufficient sanitization/escaping of a parameter before output on the page, potentially affecting admin users. Public sources (NVD/Red Hat/PatchStack/CVE lists) confirm the iss...
EUVD-2026-0705
The ShopBuilder WordPress plugin before 3.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2025-14312
The Advance WP Query Search Filter WordPress plugin through 1.0.10 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
PT-2025-53846
Name of the Vulnerable Software and Affected Versions Advance WP Query Search Filter WordPress plugin versions through 1.0.10 Description The software does not properly sanitize and escape a parameter before outputting it, resulting in a Reflected Cross-Site Scripting issue. This could potentiall...
PT-2025-51198
The URL Shortify WordPress plugin before 1.11.3 does not sanitize and escape a parameter before outputting it back in the page, leading to a reflected cross site scripting, which could be used against high-privilege users such as admins...
CVE-2025-13073 HandL UTM Grabber / Tracker < 2.8.1 - Reflected XSS via handl_landing_page
The HandL UTM Grabber / Tracker WordPress plugin before 2.8.1 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
PT-2025-50306
Name of the Vulnerable Software and Affected Versions HandL UTM Grabber / Tracker WordPress plugin versions prior to 2.8.1 Description The HandL UTM Grabber / Tracker WordPress plugin does not properly sanitize and escape a parameter before displaying it, resulting in a Reflected Cross-Site...
CVE-2024-14015
The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-14015 Studiocart <= 2.9.0 - Reflected XSS
The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-14015 Studiocart <= 2.9.0 - Reflected XSS
The WordPress eCommerce Plugin WordPress plugin through 2.9.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
EUVD-2025-119995
The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins...
CVE-2025-11560 Team Members Showcase < 3.5.0 - Reflected XSS
The Team Members Showcase WordPress plugin before 3.5.0 does not sanitize and escape a parameter before outputting it back in the page, leading to reflected cross-site scripting, which could be used against high-privilege users such as admins...
Revive Adserver: Reflected XSS in /admin/banner-zone.php (v6.0.0+)
Description: A Reflected Cross-Site Scripting Reflected XSS vulnerability. User-supplied input from the banner search fields "Website" is reflected into the page without proper context-aware encoding Step: 1. When I create Banners, I click it and click 'Linked Zones'. At that, I insert payload...
PT-2025-42460
Name of the Vulnerable Software and Affected Versions WSO2 Products affected versions not specified Description An insufficient access control implementation exists in multiple WSO2 Products. This allows bypassing authentication and authorization checks for certain REST APIs, enabling invocation...
EUVD-2023-34345
Malicious code in bioql PyPI...