40 matches found
CVE-2026-9577: Improper Neutralization of Input During Web Page Generation
The Post Status Notifier Lite WordPress plugin before 1.13.0 does not properly escape the mod URL parameter before reflecting it into the admin settings page admin.php?page=post-status-notifier-lite, leading to a Reflected Cross-Site Scripting vulnerability that fires in the administrator's sessi...
EUVD-2019-8747
Malware in sbrugna...
EUVD-2022-32878
Malicious code in bioql PyPI...
CVE-2024-46606: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in the component /admin.php?page=photo of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field...
CVE-2024-46605: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS vulnerability in the component /admin.php?page=album of Piwigo v14.5.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Description field...
Fast Flow < 1.2.13 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its Widget settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Create/edit a dashboard with an HTML widget...
Sql injection
SQL Injection vulnerability in admin/batchmanager.php in piwigo v2.9.5, via the filtercategory parameter to admin.php?page=batchmanager...
CVE-2020-19216
This CVE (CVE-2020-19216) affects Piwigo 2.9.5, where an SQL injection exists in admin/user_perm.php triggered via the cat_false parameter in admin.php?page=group_perm. The root cause is an injection vulnerability in the admin permission management flow, allowing potentially unauthorized access t...
CVE-2020-19216: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in admin/userperm.php in piwigo v2.9.5, via the catfalse parameter to admin.php?page=groupperm...
CVE-2020-19215: Improper Neutralization of Special Elements used in an SQL Command
SQL Injection vulnerability in admin/userperm.php in piwigo v2.9.5, via the catfalse parameter to admin.php?page=userperm...
SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting
The plugin does not have CSRF check in the wpsctickets AJAX action, nor has any sanitisation or escaping in some of the filter fields which could allow attackers to make a logged in user having access to the ticket lists dashboard set an arbitrary filter stored in their cookies with an XSS payloa...
CVE-2020-22148: Improper Neutralization of Input During Web Page Generation
A stored cross site scripting XSS vulnerability in /admin.php?page=tags of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML...
CVE-2020-22150: Improper Neutralization of Input During Web Page Generation
A cross site scripting XSS vulnerability in /admin.php?page=permalinks of Piwigo 2.10.1 allows attackers to execute arbitrary web scripts or HTML...
CVE-2021-24177: Improper Neutralization of Input During Web Page Generation
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...
CVE-2021-27973
SQL injection exists in Piwigo before 11.4.0 via the language parameter to admin.php?page=languages...
CVE-2019-19109: Cross-Site Request Forgery (CSRF)
The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...
CVE-2014-8945: Improper Neutralization of Special Elements used in an OS Command
admin.php?page=projects in Lexiglot through 2014-11-20 allows command injection via username and password fields...
CVE-2020-6849: Cross-Site Request Forgery (CSRF)
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketofat CSRF with resultant XSS...
CVE-2015-9413: Cross-Site Request Forgery (CSRF)
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter...