Design/Logic Flaw

The Enable SVG WordPress plugin before 1.4.0 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...

Easy Pricing Tables < 3.1.3 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks...

CVE-2022-30785

A file handle created in fuselibopendir, and later used in fuselibreaddir, enables arbitrary memory read and write operations in NTFS-3G through 2021.8.22 when using libfuse-lite...

Image Slider by NextCode <= 1.1.2 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks...

Mattermost Server is vulnerable to XSS through author_link field in Slack attachments

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the authorlink field of a Slack attachment...

GHSA-498J-WXWW-J897 Mattermost Server is vulnerable to XSS through author_link field in Slack attachments

An issue was discovered in Mattermost Server before 4.3.0, 4.2.1, and 4.1.2. XSS could occur via the authorlink field of a Slack attachment...

GHSA-FJ6P-G234-RRV3 Exposure of Sensitive Information in moodle

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

Exposure of Sensitive Information in moodle

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

UBUNTU-CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

Design/Logic Flaw

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

CVE-2022-30598

CVE-2022-30598 concerns Moodle where the global search results could disclose author information for certain activities to users who should not have access. The connected documents reiterate an information-disclosure flaw in Moodle’s global search results, but do not provide explicit root-cause d...

CVE-2022-30598

A flaw was found in moodle where global search results could include author information on some activities where a user may not otherwise have access to it...

Moodle 信息泄露漏洞

Moodle is a free, open source e-learning software platform, also known as a course management system, learning management system, or virtual learning environment. Moodle suffers from an information disclosure vulnerability that stems from the fact that global search results may contain author...

Products.CMFPlone XSS in profile home_page property

A member of the Plone site could set javascript in the homepage property of their profile, and have this executed when a visitor clicks the home page link on the author page...

double-checked-cell is unmaintained

The author recommends switching to oncecell, which offers a superset of the functionality...

WordPress Plugin stafflist 3.1.2 - SQLi (Authenticated)

Exploit Title: WordPress Plugin stafflist 3.1.2 - SQLi Authenticated Date: 05-02-2022 Exploit Author: Hassan Khan Yusufzai - Splint3r7 Vendor Homepage: https://wordpress.org/plugins/stafflist/ Version: 3.1.2 Tested on: Firefox Contact me: h at spidersilk.com Vulnerable Code: $w = isset$GET'search...