CVE-2022-4549: Undefined Security Weakness

The Tickera WordPress plugin before 3.5.1.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack...

WordPress Plugin Mautic Integration for WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2022-25202 · WordPress · Image Hover Effects

Name of the Vulnerable Software and Affected Versions: Image Hover Effects WordPress plugin versions prior to 5.5 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example...

WBCE CMS 跨站脚本漏洞

WBCE CMS is an open source content management system CMS based on PHP and MySQL. A security vulnerability exists in WBCE CMS v1.5.4, which originates from a cross-site scripting XSS vulnerability in /admin/settings/save.php. An attacker can exploit this vulnerability to execute arbitrary web scri...

PT-2022-27383

Name of the Vulnerable Software and Affected Versions WBCE CMS version 1.5.4 Description A cross-site scripting XSS issue in the /admin/settings/save.php endpoint of WBCE CMS allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field...

CVE-2022-45038

A cross-site scripting XSS vulnerability in /admin/settings/save.php of WBCE CMS v1.5.4 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Website Footer field...

Image Hover Effects < 5.5 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC Go to the plugin settings Image Hover Effects...

CVE-2022-3464

A vulnerability classified as problematic has been found in puppyCMS up to 5.1. This affects an unknown part of the file /admin/settings.php. The manipulation of the argument sitename leads to cross site scripting. It is possible to initiate the attack remotely. The associated identifier of this...

puppyCMS 跨站脚本漏洞

puppetCMS is a software application. A flat file CMS. A security vulnerability exists in puppyCMS versions prior to 5.1, which originates in an unknown section of the file /admin/settings.php, where the action parameter sitename leads to cross-site scripting XSS...

PT-2022-22262 · Puppycms · Puppycms

Name of the Vulnerable Software and Affected Versions: puppyCMS versions up to 5.1 Description: A problematic issue has been found in puppyCMS, affecting an unknown part of the file /admin/settings.php. The manipulation of the site name argument leads to cross-site scripting. It is possible to...

PT-2022-20434 · WordPress · Login Block Ips

Name of the Vulnerable Software and Affected Versions: Login Block IPs WordPress plugin versions 1.0.0 and earlier Description: The issue concerns a lack of CSRF check when updating settings in the Login Block IPs WordPress plugin. This could allow attackers to make a logged-in admin change...

CVE-2022-3098: Cross-Site Request Forgery (CSRF)

The Login Block IPs WordPress plugin through 1.0.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1591

The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-1591

The WordPress Ping Optimizer WordPress plugin before 2.35.1.3.0 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack...

CVE-2022-3036 Gettext override translations < 2.0.0 - Admin+ Stored Cross-Site Scripting

The Gettext override translations WordPress plugin before 2.0.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite set...

CVE-2022-37247

Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting XSS via /admin/settings/fields page...

CVE-2022-37247

CVE-2022-37247 concerns Craft CMS 4.2.0.1 with a stored XSS on the /admin/settings/fields page. Multiple connected sources corroborate the issue, including Red Hat and Veracode entries. The Veracode description attributes the vulnerability to improper encoding in Cp.php affecting the _fldTabHtml ...

CVE-2022-37247

Craft CMS 4.2.0.1 is vulnerable to stored a cross-site scripting XSS via /admin/settings/fields page...

PT-2022-23891

Name of the Vulnerable Software and Affected Versions Craft CMS version 4.2.0.1 Description The issue is related to a stored cross-site scripting XSS vulnerability. This occurs via the /admin/settings/fields page, allowing potential attackers to inject malicious scripts. Cross-site scripting XSS ...

Pixel＆tonic Craft CMS 跨站脚本漏洞

Pixel & tonic Craft CMS is a content management system CMS from Pixel & tonic, USA. A security vulnerability exists in Craft CMS version 4.2.0.1, which stems from a security issue on the /admin/settings/fields page...