2394 matches found
Form Builder 1.9.8.4 - Reflected Cross-Site Scripting (XSS)
The plugin does not properly sanitise and escape its fromid parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting issue. PoC The formid digits before the payload must be valid: https://example.com/wp-admin/admin.php?page=smuz-formsid=1242;alert/XSS/...
SliceWP < 1.0.46 - Reflected Cross-Site Scripting (XSS)
The plugin does not escape the converted parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=slicewp-visits="...
Electron Technologies FZC PopojiCMS 跨站脚本漏洞
PopojiCMS is a content management system, the idea is to make it easy for everyone to manage their website. popojiCMS version 1.2 /admin.php?mod=user...
WordPress 跨站请求伪造漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. A cross-site request forgery vulnerability exists in versions of the WordPress plugin Youtube Feeder prior to 2.0.1, which stems from a cross-site request forgery vulnerability in the...
CVE-2021-24496 Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)
The Community Events WordPress plugin before 1.4.8 does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in...
WordPress Plugins TaxoPress 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
WDScanner Cross-Site Scripting Vulnerability
WDScanner is an easy-to-use distributed web vulnerability detection system. version 1.1 of WDScanner has a cross-site scripting vulnerability in the system administration page, through which an attacker can execute client-side code...
TideSec WDScanner 跨站脚本漏洞
WDScanner is an easy-to-use distributed web vulnerability detection system. version 1.1 of WDScanner has a cross-site scripting vulnerability in the system administration page, through which an attacker can execute client-side code...
YzmCMS Cross-Site Scripting Vulnerability (CNVD-2021-58257)
YzmCMS is a lightweight open source content management system based on PHP Mysql architecture developed by Yuan Zhimeng alone.YzmCMS version 5.2 has a cross-site scripting vulnerability. An attacker can use the sitecode parameter in admin/index/init.html to inject and execute javascript code...
CVE-2020-22148
A stored cross site scripting XSS vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML...
Cross site scripting
A cross site scripting XSS vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML...
CVE-2020-21131
SQL Injection vulnerability in MetInfo 7.0.0beta via admin/?n=language&c=languageweb&a=doAddLanguage...
PbootCMS Cross-Site Scripting Vulnerability
PbootCMS is an open source enterprise building content management system CMS using PHP language developed by PbootCMS individual developers. PbootCMS suffers from a cross-site scripting vulnerability that stems from the product's admin.php page not properly validating client-side data. An attacke...
Monstra CMS Cross-Site Scripting Vulnerability (CNVD-2021-49037)
Monstra is a lightweight content management system CMS. A cross-site scripting vulnerability exists in Monstra version 3.0.4. The vulnerability can be exploited to conduct cross-site scripting attacks via the page function in admin/index.php...
Cross site scripting
Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php...
CVE-2020-23697
Cross Site Scripting vulnerabilty in Monstra CMS 3.0.4 via the page feature in admin/index.php...
Community Event < 1.4.8 - Reflected Cross-Site Scripting (XSS)
The plugin does not sanitise, validate or escape its importrowscount and successimportcount GET parameters before outputting them back in an admin page, leading to a reflected Cross-Site Scripting issue which will be executed in the context of a logged in administrator PoC...
WP SMS < 5.4.9.1 - Reflected Cross-Site Scripting (XSS)
The plugin does not sanitise or escape some of its parameter before outputting them back in the pages, leading to reflected Cross-Site Scripting issues which will be executed in the context of a logged in admin. alert/XSS/' / alert/XSS/' / alert/XSS/' /...
Event Espresso Core < 4.10.7.p - Reflected Cross-Site Scripting (XSS)
The adminpages/messages/templates/eemsgadminoverview.template.php file of the plugin did not escape user input before outputting back in an attribute in the page, leading to a reflected Cross-Site Scripting issue...
