2767 matches found
CVE-2016-10952
The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...
CVE-2017-18613
The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter...
CVE-2017-18602
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examappUserResult id parameter...
CVE-2017-18602
The examapp plugin 1.0 for WordPress has SQL injection via the wp-admin/admin.php?page=examappUserResult id parameter...
GitLab: Stored XSS for Grafana dashboard URL
Hi GitLab Security Team Summary I found a stored XSS vulnerability in the admins page. The administrator can set up a Grafana dashboard. Here, the administrator can either enter a relative URL or an absolute address. However, when adding an absolute URL, the protocol is not checked allowing to ad...
CVE-2019-14789
The Custom 404 Pro plugin 3.2.8 for WordPress has XSS via the wp-admin/admin.php?page=c4p-main page parameter...
PT-2019-13834 · WordPress · Custom 404 Pro
Name of the Vulnerable Software and Affected Versions: Custom 404 Pro plugin version 3.2.8 Description: The issue concerns a problem with the Custom 404 Pro plugin for WordPress, where there is an XSS issue via the "page" parameter in the wp-admin/admin.php page. Recommendations: For Custom 404 P...
CVE-2017-18493
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues...
CVE-2017-18493
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues...
Cross site scripting
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues...
CVE-2017-18493
The CVE-2017-18493 entry concerns the WordPress plugin Custom Admin Page by BestWebSoft
PT-2019-8428
Name of the Vulnerable Software and Affected Versions custom-admin-page plugin versions prior to 0.1.2 Description The issue concerns multiple XSS problems. Recommendations For versions prior to 0.1.2, update to version 0.1.2 or later to resolve the issue...
CVE-2017-18493: Improper Neutralization of Input During Web Page Generation
The custom-admin-page plugin before 0.1.2 for WordPress has multiple XSS issues...
CVE-2016-10865
The Lightbox Plus Colorbox plugin through 2.7.2 for WordPress has cross-site request forgery CSRF via wp-admin/admin.php?page=lightboxplus, as demonstrated by resultant width XSS...
CVE-2019-14679
core/views/arpriceimportexport.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arpliteimportexport CSRF...
Design/Logic Flaw
The woo-variation-swatches aka Variation Swatches for WooCommerce plugin 1.0.61 for WordPress allows XSS via the wp-admin/admin.php?page=woo-variation-swatches-settings tab parameter...
CVE-2019-14335
An issue was discovered on D-Link 6600-AP and DWL-3600AP Ax 4.2.0.14 21/03/2019 devices. There is post-authenticated denial of service leading to the reboot of the AP via the admin.cgi?action=%s URI...
Authentication Bypass
yourls is vulnerable to authentication bypass. The authentication functions consist of a type-juggling vulnerability that allows an attacker to use non-strict comparisons to bypass authentication and perform unauthorized actions in the admin page and API...
PT-2019-13776 · WordPress · Admin-Renamer-Extended
Name of the Vulnerable Software and Affected Versions: admin-renamer-extended plugin version 3.2.1 Description: The issue allows for a CSRF attack on the wp-admin/plugins.php?page=admin-renamer-extended/admin.php page. Recommendations: For admin-renamer-extended plugin version 3.2.1, consider...