1831 matches found
CVE-2023-39249
Dell SupportAssist for Business PCs version 3.4.0 contains a local Authentication Bypass vulnerability that allows locally authenticated non-admin users to gain temporary privilege within the SupportAssist User Interface on their respective PC. The Run as Admin temporary privilege feature enables...
Wago Multiple Products Incorrect Authorization (CVE-2023-3379)
Wago web-based management of multiple products has a vulnerability which allows an local authenticated attacker to change the passwords of other non-admin users and thus to escalate non-root privileges. This plugin only works with Tenable.ot. Please visit https://www.tenable.com/products/tenable-...
CVE-2024-0566
The Smart Manager WordPress plugin before 8.28.0 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
PT-2024-15016 · WordPress · Popup Box
Name of the Vulnerable Software and Affected Versions: Popup Box WordPress plugin versions prior to 20.9.0 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks even when unfiltered html is disallowed, due to the plugin not sanitizing and...
CVE-2024-24807
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones...
Design/Logic Flaw
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones...
Sulu HTML Injection via Autocomplete Suggestion
Impact It is an issue when input HTML into the Tag name. The HTML is execute when the tag name is listed in the auto complete form. Only admin users are affected and only admin users can create tags. Patches Has the problem been patched? What versions should users upgrade to? The problem is patch...
CVE-2024-24807 Sulu is vulnerable to HTML Injection via Autocomplete Suggestion
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones...
CVE-2024-24807
CVE-2024-24807 — Sulu HTML Injection via Autocomplete Suggestion What is affected: Sulu CMS (PHP, Symfony) — specifically the auto-complete form used when creating Tag names. Root cause: HTML input in Tag name is executed when listed in the autocomplete, indicating inadequate input sanitization f...
CVE-2024-24807 Sulu is vulnerable to HTML Injection via Autocomplete Suggestion
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones...
CVE-2024-24807: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)
Sulu is a highly extensible open-source PHP content management system based on the Symfony framework. There is an issue when inputting HTML into the Tag name. The HTML is executed when the tag name is listed in the auto complete form. Only admin users can create tags so they are the only ones...
CVE-2023-50357
A cross site scripting vulnerability in the AREAL SAS Websrv1 ASP website allows a remote low-privileged attacker to gain escalated privileges of other non-admin users...
CVE-2023-50357
A cross site scripting vulnerability in the AREAL SAS Websrv1 ASP website allows a remote low-privileged attacker to gain escalated privileges of other non-admin users...
CVE-2023-50357 Cross site scripting vulnerability in AREAL SAS Webserv1 ASP Web Site
A cross site scripting vulnerability in the AREAL SAS Websrv1 ASP website allows a remote low-privileged attacker to gain escalated privileges of other non-admin users...
Persian Fonts <= 1.6 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. PoC 1. Navigate to:...
PT-2024-14848 · WordPress · Wp-Adv-Quiz
Name of the Vulnerable Software and Affected Versions: Wp-Adv-Quiz WordPress plugin versions prior to 1.0.3 Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the plugin not sanitizing and...
CVE-2023-50785
Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...
Path traversal
Zoho ManageEngine ADAudit Plus before 7270 allows admin users to view names of arbitrary directories via path traversal...
CVE-2023-50785
The issue concerns Zoho ManageEngine ADAudit Plus prior to build 7270, which is affected by a directory traversal vulnerability that allows admin users to view names of arbitrary directories outside the designated installation directory. The root cause is path traversal (no exploitation details p...