CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

CVE-2017-17775

Piwigo 2.9.2 is vulnerable to a cross-site scripting (XSS) flaw triggered by the name parameter in an admin.php?page=album-3-properties request. The issue affects the web-based photo gallery software as described in CVE-2017-17775; details in connected records confirm the vulnerability class and ...

CVE-2017-17775: Improper Neutralization of Input During Web Page Generation

Piwigo 2.9.2 has XSS via the name parameter in an admin.php?page=album-3-properties request...

PT-2017-14992

Name of the Vulnerable Software and Affected Versions Piwigo version 2.9.2 Description The issue allows for XSS via the name parameter in an "admin.php?page=album-3-properties" request. Recommendations For Piwigo version 2.9.2, avoid using the name parameter in the...

PT-2017-14997

Name of the Vulnerable Software and Affected Versions Clockwork Free and Paid SMS Notifications versions 2.0.3 Two-Factor Authentication - Clockwork SMS version 1.0.2 Booking Calendar - Clockwork SMS version 1.0.5 Contact Form 7 - Clockwork SMS version 2.3.0 Fast Secure Contact Form - Clockwork S...

CVE-2017-17780: Improper Neutralization of Input During Web Page Generation

The Clockwork SMS clockwork-test-message.php component has XSS via a crafted "to" parameter in a clockwork-test-message request to wp-admin/admin.php. This component code is found in the following WordPress plugins: Clockwork Free and Paid SMS Notifications 2.0.3, Two-Factor Authentication -...

Cross site scripting

The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator...

CVE-2017-16904

The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator...

CVE-2017-16904

The CVE concerns LvyeCMS (admin.php, Public tologin) up to version 3.1 where a crafted username enables cross-site scripting. The underlying cause is mishandling of the username during admin log viewing, allowing an attacker to inject Web script/HTML that is executed in an administrator’s view. S...

CVE-2017-16904

The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator...

PT-2017-14631

Name of the Vulnerable Software and Affected Versions LvyeCMS versions prior to 3.1 Description The issue concerns the Public tologin feature in admin.php, which allows for XSS attacks through a crafted username that is mishandled during later log viewing by an administrator. Recommendations For...

CVE-2017-16904: Improper Neutralization of Input During Web Page Generation

The Public tologin feature in admin.php in LvyeCMS through 3.1 allows XSS via a crafted username that is mishandled during later log viewing by an administrator...

PT-2017-14607 · WordPress · Updraftplus

Name of the Vulnerable Software and Affected Versions: UpdraftPlus plugin versions 1.13.12 and earlier Description: The issue concerns a Server-Side Request Forgery SSRF in the updraft ajax handler function, located in /wp-content/plugins/updraftplus/admin.php, which can be exploited via an httpg...

CVE-2017-16871: Improper Control of Generation of Code

The UpdraftPlus plugin through 1.13.12 for WordPress allows remote PHP code execution because the pluploadaction function in /wp-content/plugins/updraftplus/admin.php has a race condition before deleting a file associated with the name parameter. NOTE: the vendor reports that this does not cross ...

PT-2017-14608 · WordPress · Updraftplus

Name of the Vulnerable Software and Affected Versions: UpdraftPlus plugin versions 1.13.12 and earlier Description: The issue allows remote PHP code execution due to a race condition in the plupload action function before deleting a file associated with the name parameter in...

CVE-2017-16870: Server-Side Request Forgery (SSRF)

The UpdraftPlus plugin through 1.13.12 for WordPress has SSRF in the updraftajaxhandler function in /wp-content/plugins/updraftplus/admin.php via an httpget subaction. NOTE: the vendor reports that this does not cross a privilege boundary...

CVE-2017-15810

The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php...

PT-2017-14240

Name of the Vulnerable Software and Affected Versions PopCash.Net Code Integration Tool plugin version prior to 1.1 Description The issue allows for XSS via the tab parameter to "wp-admin/admin.php". Recommendations For versions prior to 1.1, update to version 1.1 or later to resolve the issue...