CVE-2021-36830: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Comment Guestbook plugin = 0.8.0 at WordPress...

CVE-2022-40672: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in CPO Shortcodes plugin = 1.5.0 at WordPress...

CVE-2022-40217: Unrestricted Upload of File with Dangerous Type

Authenticated admin+ Arbitrary File Edit/Upload vulnerability in XplodedThemes WPide plugin = 2.6 at WordPress...

Advanced Comment Form < 1.2.1 - Admin+ Authenticated Stored XSS

The plugin does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. In the settings of the plugin, add the following payload to the text before the form:...

CVE-2022-37412: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Reflected Cross-Site Scripting XSS vulnerability in Galerio & Urda's Better Delete Revision plugin = 1.6.1 at WordPress...

CVE-2022-38068: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Apasionados Export Post Info plugin = 1.1.0 at WordPress...

CVE-2022-35725: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in Hans Matzen's wp-forecast plugin = 7.5 at WordPress...

CVE-2022-35235

Authenticated admin+ Arbitrary File Read vulnerability in XplodedThemes WPide plugin = 2.6 at WordPress...

CVE-2021-36849: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in René Hermenau's Social Media Share Buttons plugin = 3.8.1 at WordPress...

CVE-2021-36844: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Stored Cross-Site Scripting XSS vulnerability in MyThemeShop WP Subscribe plugin = 1.2.12 on WordPress...

CVE-2021-36828: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Stored Cross-Site Scripting XSS in WP Maintenance plugin = 6.0.7 versions...

CVE-2021-23174: Improper Neutralization of Input During Web Page Generation

Authenticated admin+ Persistent Cross-Site Scripting XSS vulnerability discovered in Download Monitor WordPress plugin versions = 4.4.6 Vulnerable parameters: &posttitle, &downloadablefileversion0...

CVE-2021-32103

A Stored XSS vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter...

CVE-2021-32103

A Stored XSS vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter...

CVE-2021-32103: Improper Neutralization of Input During Web Page Generation

A Stored XSS vulnerability in interface/usergroup/usergroupadmin.php in OpenEMR before 5.0.2.1 allows a admin authenticated user to inject arbitrary web script or HTML via the lname parameter...

CVE-2020-12687: Exposure of Resource to Wrong Sphere

An issue was discovered in Serpico before 1.3.3. The /admin/attacmentsbackup endpoint can be requested by non-admin authenticated users. This means that an attacker with a user account can retrieve all of the attachments of all users including administrators from the database...

CVE-2018-16248

CVE-2018-16248 affects b3log Solo 2.9.3. An XSS flaw exists in the Input page under the “Publish Articles” menu, where the articleTags field stored in the tag JSON enables an admin-authenticated HTTP request to inject arbitrary scripts via a crafted site name. The vulnerability is caused by insuf...

CVE-2018-16248

b3log Solo 2.9.3 has XSS in the Input page under the "Publish Articles" menu with an ID of "articleTags" stored in the "tag" JSON field, which allows remote attackers to inject arbitrary Web scripts or HTML via a carefully crafted site name in an admin-authenticated HTTP request...

CVE-2018-16249

In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated us...

Code injection

In Symphony before 3.3.0, there is XSS in the Title under Post. The ID "articleTitle" of this is stored in the "articleTitle" JSON field, and executes a payload when accessing the /member/test/points URI, allowing remote attacks. Any Web script or HTML can be inserted by an admin-authenticated us...