7262 matches found
CVE-2023-32498
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Easy Form team Easy Form by AYS plugin = 1.2.0 versions...
CVE-2023-32498 WordPress Easy Form by AYS Plugin <= 1.2.0 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Easy Form team Easy Form by AYS plugin = 1.2.0 versions...
CVE-2023-32498
CVE-2023-32498 : WordPress plugin Easy Form by AYS, affected versions ≤ 1.2.0, suffers a stored XSS vulnerability that requires administrator privileges. Patch available in version 1.2.1; update to 1.2.1 or later to fix.
DEBIAN-CVE-2022-48547
A reflected cross-site scripting XSS vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at authchangepassword.php...
UBUNTU-CVE-2022-48547
A reflected cross-site scripting XSS vulnerability in Cacti 0.8.7g and earlier allows unauthenticated remote attackers to inject arbitrary web script or HTML in the "ref" parameter at authchangepassword.php...
Cacti 跨站脚本漏洞
Cacti is a set of open source network traffic monitoring and analysis tools from the Cacti team. The tool obtains data via snmpget, analyzes it using RRDtool drawing graphs, and provides data and user management features. A cross-site scripting vulnerability exists in Cacti 0.8.7g and earlier...
Fluent CMS 1.0.0 SQL Injection
==================================================================================================================================== | Title : Fluent CMS V 1.0.0 Auth by pass Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefox 77.0.132-bit | ...
Ivanti Sentry MICSLogService Auth Bypass resulting in RCE (CVE-2023-38035)
This module exploits an authentication bypass in Ivanti Sentry which exposes API functionality which allows for code execution in the context of the root user. Module Options msf use exploit/linux/http/ivanti/sentrymisclogservice msf undefinedsentrymisclogservice show actions ...actions... msf...
Exploit for CVE-2023-38646
Metabase Metabase is an open source business intelligence tool...
CVE-2023-32130
CVE-2023-32130 affects WordPress Multi Rating Plugin prior to or at version 5.0.6. It is a Stored Cross-Site Scripting (XSS) vulnerability in the plugin’s settings exposed to authenticated administrators. The CVSS vectors in the initial entry show a low-to-medium base impact with user interaction...
CVE-2023-29387
CVE-2023-29387 affects the WordPress plugin Manager for Icomoon (Julien Crego) with a Stored Cross-Site Scripting (XSS) vulnerability in versions ≤ 2.0, exploitable by users with contributor+ permissions. Multiple sources corroborate a fix in version 2.2; update to >2.0 (ideally 2.2 or later) ...
Important Cookie without Secure flag
Description Cookie accessToken is without Secure flag. Mentioned cookie is responsible for user auth. Proof of Concept Repro steps: As logged in user https://app.vrite.io/ open DevTools and check Cookies table, get value of accessToken cookie. Open other browser, go to app.vrite.io site, open...
CVE-2023-28690 WordPress WP BrowserUpdate Plugin <= 4.5 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Marco Steinbrecher WP BrowserUpdate plugin = 4.5 versions...
CVE-2023-31079
CVE-2023-31079 affects the WordPress Tippy plugin 6.2.1 and earlier (
CVE-2023-30784 WordPress Kaya QR Code Generator Plugin <= 1.5.2 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Kaya Studio Kaya QR Code Generator plugin = 1.5.2 versions...
CVE-2023-30778
CVE-2023-30778 is a stored XSS vulnerability in the Blubrry PowerPress Podcasting plugin for WordPress, affecting versions ≤ 10.0.1. The flaw arises from how user-supplied data can be stored and later reflected in output (stored XSS via shortcode), potentially enabling an attacker with contributo...
CVE-2023-30778 WordPress PowerPress Podcasting Plugin <= 10.0.1 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Blubrry PowerPress Podcasting plugin by Blubrry plugin = 10.0.1 versions...
Ubuntu 20.04 LTS / 22.04 LTS / 23.04 : MySQL vulnerabilities (USN-6288-1)
The remote Ubuntu 20.04 LTS / 22.04 LTS / 23.04 host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-6288-1 advisory. Multiple security issues were discovered in MySQL and this update includes new upstream MySQL versions to fix these issues. MySQL has...
CVE-2023-30752
The CVE-2023-30752 entry concerns the WordPress External Videos plugin and is documented as an authentication‑required Stored XSS in versions <= 2.0.1. Affected component: External Videos plugin; root cause: insufficient input filtering/escaping that allows stored script execution when an admi...
CVE-2023-30751 WordPress Article Directory Redux Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in iControlWP Article Directory Redux plugin = 1.0.2 versions...