CVE-2023-28422

Auth. admin+ Stored Cross-site Scripting XSS vulnerability in MagePeople Team Event Manager and Tickets Selling Plugin for WooCommerce = 3.8.6. versions...

CVE-2023-25794

Auth. admin+ Cross-Site Scripting XSS vulnerability in Mighty Digital Nooz plugin = 1.6.0 versions...

CVE-2023-25795

Auth. admin+ Cross-Site Scripting XSS vulnerability in WP-master.Ir Feed Changer & Remover plugin = 0.2 versions...

CVE-2023-1374

The Solidres plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'currencyname' parameter in versions up to, and including, 0.9.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrator privileges to...

SUSE CVE-2015-3902

Multiple cross-site request forgery CSRF vulnerabilities in the setup process in phpMyAdmin 4.0.x before 4.0.10.10, 4.2.x before 4.2.13.3, 4.3.x before 4.3.13.1, and 4.4.x before 4.4.6.1 allow remote attackers to hijack the authentication of administrators for requests that modify the configurati...

SUSE CVE-2016-1607

Multiple cross-site request forgery CSRF vulnerabilities in the administrative interface in Novell Filr before 2.0 Security Update 2 allow remote attackers to hijack the authentication of administrators, as demonstrated by reconfiguring time settings via a vaconfig/time request...

CVE-2023-0446

The My YouTube Channel plugin for WordPress is vulnerable to Stored Cross-Site Scripting via its settings parameters in versions up to, and including, 3.0.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2022-43470

Cross-site request forgery CSRF vulnerability in +F FS040U software versions v2.3.4 and earlier, +F FS020W software versions v4.0.0 and earlier, +F FS030W software versions v3.3.5 and earlier, and +F FS040W software versions v1.4.1 and earlier allows an adjacent attacker to hijack the...

FUJISOFT +F FS040U 跨站请求伪造漏洞

FUJISOFT +F FS040U is a LTE USB converter from FUJISOFT Japan. A security vulnerability exists in FUJISOFT +F FS040U v2.3.4 and earlier, +F FS020W v4.0.0 and earlier, +F FS030W v3.3.5 and earlier, +F FS040W v4.1 and earlier, that originates from a vulnerability that could allow a nearby attacker ...

PT-2022-26000 · Unknown · Accessibility Plugin

Name of the Vulnerable Software and Affected Versions: Accessibility plugin versions prior to 1.0.4 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin or higher privileges. Recommendations: For versions prior to 1.0.4, upda...

CVE-2022-44591

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Anthologize plugin = 0.8.0 on WordPress...

CVE-2022-40694

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in News Announcement Scroll plugin = 8.8.8 on WordPress...

CVE-2022-44576

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in AgentEasy Properties plugin = 1.0.4 on WordPress...

CVE-2022-23726

PingCentral versions prior to listed versions expose Spring Boot actuator endpoints that with administrative authentication return large amounts of sensitive environmental and application information...

PT-2022-16230 · Unknown · Spring Boot +1

Name of the Vulnerable Software and Affected Versions: PingCentral versions prior to listed versions Description: The issue exposes Spring Boot actuator endpoints, which can return large amounts of sensitive environmental and application information when accessed with administrative authenticatio...

CVE-2022-32776

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Advanced Ads GmbH Advanced Ads – Ad Manager & AdSense plugin = 1.31.1 on WordPress...

CVE-2022-26479

Poly EagleEye Director II (pre-2.2.2.1) contains an authentication bypass vulnerability where the existence of a certain file (creatable via an rsync backdoor) causes all API calls to run with admin privileges. Affected component/file path is unspecified in the initial documents; root cause is an...

CVE-2022-23169

attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel...

CVE-2022-1764

The WP-chgFontSize WordPress plugin through 1.8 does not have CSRF check in place when updating its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and lead to Stored Cross-Site Scripting due to the lack of sanitisation and escaping...

CVE-2022-23169

attacker needs to craft a SQL payload. the vulnerable parameter is "agentid" must be authenticated to the admin panel...