5821 matches found
GiveWP < 2.25.2 - Author+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Author to perform Cross-Site Scripting attacks...
GHSA-3738-P9X3-MV9R XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
Impact It's possible to use the right of an existing document content author to execute a text area property. To reproduce: As an admin with programming rights, create a new user without script or programming right. Login with the freshly created user. Insert the following text in source mode in...
XWiki Platform vulnerable to privilege escalation via properties with wiki syntax that are executed with wrong author
Impact It's possible to use the right of an existing document content author to execute a text area property. To reproduce: As an admin with programming rights, create a new user without script or programming right. Login with the freshly created user. Insert the following text in source mode in...
CVE-2023-27560
Math/PrimeField.php in phpseclib 3.x before 3.0.19 has an infinite loop with composite primefields...
CVE-2023-26474
XWiki Platform is a generic wiki platform. Starting in version 13.10, it's possible to use the right of an existing document content author to execute a text area property. This has been patched in XWiki 14.10, 14.4.7, and 13.10.11. There are no known workarounds...
Instant Images < 5.2.0 - Author+ SSRF
The plugin does not validate a parameter before making a request to it, which could allow users with Author role and above to perform SSRF attack...
XWiki Platform 安全漏洞
XWiki Platform is a suite of Wiki platforms for creating Web collaboration applications from the French company XWiki. A security vulnerability exists in XWiki Platform that stems from allowing any action to be performed with the privileges of any document author via an annotated document...
PT-2023-20665 · Xwiki · Xwiki Platform
Name of the Vulnerable Software and Affected Versions: XWiki Platform versions 13.10 through 14.4.6 XWiki Platform versions 13.10 through 13.10.10 XWiki Platform versions 14.0 through 14.4.6 Description: The issue allows an attacker to use the rights of an existing document content author to...
CVE-2023-0285
The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0285 Real Media Library < 4.18.29 - Author+ Stored XSS
The Real Media Library WordPress plugin before 4.18.29 does not sanitise and escape the created folder names, which could allow users with the role of author and above to perform Stored Cross-Site Scripting attacks...
pfBlockerNG 2.1.4_26 - Remote Code Execution Exploit
Exploit Title: pfBlockerNG 2.1.426 - Remote Code Execution RCE Shodan Results: https://www.shodan.io/search?query=http.title%3A%22pfSense+-+Login%22+%22Server%3A+nginx%22+%22Set-Cookie%3A+PHPSESSID%3D%22 Date: 5th of September 2022 Exploit Author: IHTeam Vendor Homepage:...
FluentSMTP < 2.2.3 - Stored XSS via Email Logs
The plugin does not sanitize or escape email content, making it vulnerable to stored cross-site scripting attacks XSS when an administrator views the email logs. This exploit requires other plugins to enable users to send emails with unfiltered HTML. XSS Payload : Steps to reproduce: 1. Install...
SUSE CVE-2003-0855
Pan 0.13.3 and earlier allows remote attackers to cause a denial of service crash via a news post with a long author email address...
SUSE CVE-2012-0220
Multiple cross-site scripting XSS vulnerabilities in the meta plugin Plugin/meta.pm in ikiwiki before 3.20120516 allow remote attackers to inject arbitrary web script or HTML via the 1 author or 2 authorurl meta tags...
SUSE CVE-2012-4465
Heap-based buffer overflow in the substr function in parsing.c in cgit 0.9.0.3 and earlier allows remote authenticated users to cause a denial of service crash and possibly execute arbitrary code via an empty username in the "Author" field in a commit...
SUSE CVE-2015-0251
The moddavsvn server in Subversion 1.5.0 through 1.7.19 and 1.8.0 through 1.8.11 allows remote authenticated users to spoof the svn:author property via a crafted v1 HTTP protocol request sequences...
SUSE CVE-2019-8942
WordPress before 4.9.9 and 5.x before 5.0.1 allows remote code execution because an wpattachedfile Post Meta entry can be changed to an arbitrary string, such as one ending with a .jpg?file.php substring. An attacker with author privileges can execute arbitrary code by uploading a crafted image...
Jobs for WordPress < 2.6.0 - Author+ Stored XSS
The plugin does not sanitise and escape some parameters, which could allow users with a role as low as Author to perform Stored Cross-Site Scripting attacks...
WordPress Real Media Library Lite Plugin < 4.18.29 is vulnerable to Cross Site Scripting (XSS)
Software Real Media Library Lite Type Plugin Vulnerable versions 4.18.29 Fixed in 4.18.29 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0285 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID 7250628ea15a Credits Bipul...