Advanced Booking Calendar < 1.7.1 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the room parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue PoC...

Design/Logic Flaw

Piwigo v12.2.0 was discovered to contain an information leak via the action parameter in /admin/maintenanceactions.php...

Atom CMS Remote Code Execution Vulnerability

Atom CMS is a content management system. A remote code execution vulnerability exists in Atom CMS version 2.0, which stems from /admin/uploads.php failing to properly filter the special elements of the construct snippet. An attacker could exploit this vulnerability to cause arbitrary code executi...

WordPress ARI Fancy Lightbox plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress application plugin. cross-site scripting vulnerability exists in versions of the WordPress ARI Fancy Lightbox plugin prior to 1.3.9, which stems from a...

CVE-2022-0601

The Countdown, Coming Soon, Maintenance WordPress plugin before 2.2.9 does not sanitize and escape the post parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0648

The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the orderpos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

CVE-2022-0648 Team Circle Image Slider With Lightbox < 1.0.16 - Reflected Cross-Site Scripting

The Team Circle Image Slider With Lightbox WordPress plugin before 1.0.16 does not sanitize and escape the orderpos parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting...

Ad Inserter < 2.7.12 - Reflected Cross-Site Scripting

The plugins do not sanitise and escape the REQUESTURI before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters PoC In a browser which does not encode characters:...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in Countdown,...

CVE-2021-44620

A Command Injection vulnerability exits in TOTOLINK A3100R =V4.1.2cu.5050B20200504 in adm/ntm.asp via the hosTime parameters...

CVE-2022-24604

Luocms v2.0 is affected by SQL Injection in /admin/link/linkmod.php...

UpdraftPlus < 1.22.9 - Reflected Cross-Site Scripting

The plugin does not sanitise and escape the updraftinterval parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting XSS vulnerability. PoC https://example.com//wp-admin/options-general.php?page=updraftplusinterval"confirm1...

CVE-2021-24953

The Advanced iFrame WordPress plugin before 2022 does not sanitise and escape the aiconfigid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue...

WordPress plugin 跨站脚本漏洞

WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is a WordPress application plugin. WordPress Advanced iFrame plugin versions prior to 2022 contain a cross-site scripting vulnerability that stems from the plugin's failure to...

Conference Scheduler < 2.4.3 - Reflected Cross-Site Scripting

The plugin does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/edit.php?posttype=confworkshop=confscheduleroptions="...

CVE-2022-25115

A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...

CVE-2022-25115

A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...

Remote code execution

A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...

CVE-2022-25115

A remote code execution RCE vulnerability in the Avatar parameter under /admin/?page=user/manageuser of Home Owners Collection Management System v1.0 allows attackers to execute arbitrary code via a crafted PNG file...

Bank Mellat <= 1.3.7 - Reflected Cross-Site Scripting

The plugin does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting. PoC https://example.com/wp-admin/admin.php?page=bank-mellat="...