CVE-2023-0899 Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated Stored XSS

The Steveas WP Live Chat Shoutbox WordPress plugin through 1.4.2 does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins...

Clock In Portal <= 2.1 - Designation Deletion via CSRF

The plugin does not have CSRF check when deleting designations, which could allow attackers to make logged in admins delete arbitrary designations via a CSRF attack Make a logged in admin open a page with the code below, this will make them delete the Designation with ID 2...

Discourse 安全漏洞

Discourse is an open source community discussion platform. The platform includes community, email, and chat room features. A security vulnerability exists in Discourse that originates from a user logged in as an administrator being able to call any method on the SiteSetting class, which can affec...

CVE-2022-44734 WordPress Car Rental by BestWebSoft Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in BestWebSoft Car Rental by BestWebSoft plugin = 1.1.2 versions...

PT-2023-21663 · Zoho · Zoho Manageengine Applications Manager

Name of the Vulnerable Software and Affected Versions: Zoho ManageEngine Applications Manager versions through 16320 Description: The issue allows an admin user to conduct an XXE attack. Recommendations: For versions through 16320, update to a version that contains a fix for this issue to prevent...

CVE-2023-1425 Groundhogg Contacts < 2.7.9.4 - Admin+ SQLi

The WordPress CRM, Email & Marketing Automation for WordPress | Award Winner — Groundhogg WordPress plugin before 2.7.9.4 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admins...

CVE-2023-24403

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WP For The Win bbPress Voting plugin = 2.1.11.0 versions...

CVE-2023-24387 WordPress Organization chart Plugin <= 1.4.4 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPdevart Organization chart plugin = 1.4.4 versions...

CVE-2023-23870

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in wpdevart Responsive Vertical Icon Menu plugin = 1.5.8 versions...

CVE-2022-47607 WordPress Usersnap Plugin <= 4.16 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Usersnap plugin = 4.16 versions...

CVE-2022-47170

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates plugin = 1.5.48 versions...

CVE-2023-22716

Auth. admin+ Cross-Site Scripting vulnerability in OOPSpam OOPSpam Anti-Spam plugin = 1.1.35 versions...

W4 Post List < 2.4.6 - Reflected XSS

The plugin does not escape some URLs before outputting them in attributes, leading to Reflected Cross-Site Scripting PoC Make a logged in admin open https://example.com/wp-admin/edit.php?posttype=w4pl=w4pl-docs" On a page where there is a list with navigation displayed put a nav in the template o...

CVE-2023-25782 WordPress Service Area Postcode Checker Plugin <= 2.0.8 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ vulnerability in Second2none Service Area Postcode Checker plugin = 2.0.8 versions...

CVE-2023-24249

An arbitrary file upload vulnerability in laravel-admin v1.8.19 allows attackers to execute arbitrary code via a crafted PHP file...

JSA10414 - Pulse Connect Secure (PCS) and Pulse Policy Secure (PPS) - Security Bundle - Admin Issue

Ivanti 4th of March 2024 - This isn't an active SA and any new edits are part of an article maintenance project. Admin vulnerability found and fixed through a combination of internal and external proactive security testing: - When an admin uses certain sub-menus within the console, a timeout is...

@activitypods/react (>=2.0.0-alpha.13 <=2.2.0), @amplicode/addon-camunda (>=0.0.1-snapshot.1 <=0.0.1-snapshot.9) +56 more potentially affected by CVE-2023-25572 via react-admin (>=4.12.1 <=4.16.20)

react-admin NPM version =4.12.1, =2.0.0-alpha.13, =0.0.1-snapshot.1, =0.0.1-snapshot.1, =0.0.1, =3.0.0, =1.0.10, =0.0.1, =0.0.1, =0.0.1, =1.0.0, =0.0.4, =0.1.33, =4.0.0, =1.1.0, =1.0.0, =1.6.7 and more Source cves: CVE-2023-25572 Source advisory: OSV:GHSA-5JCR-82FH-339V...

@api-platform/admin (>=0.5.0 <=1.0.2), @bishoy_melek_wadie/react-admin-firebase (>=0.9.0 <=0.9.1) +69 more potentially affected by CVE-2023-25572 via react-admin (>=2.4.2 <=3.19.11)

react-admin NPM version =2.4.2, =0.5.0, =0.9.0, =0.0.1, =1.0.0, =0.6.5, =0.6.3, =0.8.11, =1.0.1, =1.0.0, =1.0.0, =1.2.0, =1.2.2 and more Source cves: CVE-2023-25572 Source advisory: OSV:GHSA-5JCR-82FH-339V...

CVE-2022-47762

In gin-vue-admin 2.5.5, the download module has a Path Traversal vulnerability...

CVE-2022-4472 Simple Sitemap < 3.5.8 - Contributor+ Stored XSS

The Simple Sitemap WordPress plugin before 3.5.8 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privile...