6711 matches found
CVE-2024-13056
The Dyn Business Panel WordPress plugin through 1.0.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2024-53282
Improper neutralization of input during web page generation 'Cross-site Scripting' vulnerability in WiFi Connect MAC Filter functionality in Synology Router Manager SRM before 1.3.1-9346-10 allows remote authenticated users with administrator privileges to read or write specific files containing...
CVE-2024-9828
The Taskbuilder WordPress plugin before 3.0.5 does not sanitize user input into the 'loadorders' parameter and uses it in a SQL statement, allowing high privilege users such as admin to perform SQL Injection attacks...
CVE-2024-54682
Mattermost versions 10.1.x = 10.1.2, 10.0.x = 10.0.2, 9.11.x = 9.11.4, 9.5.x = 9.5.12 fail to limit the file size for slack import file uploads which allows a user to cause a DoS via zip bomb by importing data in a team they are a team admin...
CVE-2023-25477
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Yotuwp Video Gallery plugin = 1.3.12 versions...
CVE-2023-30746
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Booqable Rental Software Booqable Rental plugin = 2.4.15 versions...
CVE-2023-28690
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Steinbrecher WP BrowserUpdate plugin = 4.5 versions...
CVE-2023-26541
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Alexander Suess asMember plugin = 1.5.4 versions...
CVE-2023-41737
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in WPGens Swifty Bar, sticky bar by WPGens plugin = 1.2.10 versions...
CVE-2023-25702
Auth. admin+ Stored Cross-site Scripting XSS vulnerability in Fullworks Quick Paypal Payments plugin = 5.7.25 versions...
CVE-2023-25979
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Video Gallery by Total-Soft Video Gallery plugin = 1.7.6 versions...
CVE-2023-25490
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.4 versions...
CVE-2023-25460
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in CodeSolz Easy Ad Manager plugin = 1.0.0 versions...
CVE-2023-25963
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in JoomSky JS Job Manager plugin = 2.0.0 versions...
CVE-2023-34043
VMware Aria Operations contains a local privilege escalation vulnerability. A malicious actor with administrative access to the local system can escalate privileges to 'root'...
CVE-2023-30751
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in iControlWP Article Directory Redux plugin = 1.0.2 versions...
CVE-2023-30876
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Dave Ross Dave's WordPress Live Search plugin = 4.8.1 versions...
CVE-2023-30803
The Sangfor Next-Gen Application Firewall version NGAF8.0.17 is vulnerable to an authentication bypass vulnerability. A remote and unauthenticated attacker can bypass authentication and access administrative functionality by sending HTTP requests using a crafted Y-forwarded-for header...