6348 matches found
CVE-2022-1755 SVG Support < 2.5 - Author+ Stored Cross-Site Scripting
The SVG Support WordPress plugin before 2.5 does not properly handle SVG added via an URL, which could allow users with a role as low as author to perform Cross-Site Scripting attacks...
Active eCommerce CMS 6.3.0 Arbitrary File Download
Exploit Title: Active eCommerce CMS Arbitrary File Download Exploit Author: th3d1gger Vendor Homepage: https://codecanyon.net Software Link: https://codecanyon.net/item/active-ecommerce-cms/23471405 Version: Version 6.3.0 Tested on Ubuntu 18.04 without authentication with for loop user can downlo...
PT-2022-24180 · WordPress · Export Post Info
Name of the Vulnerable Software and Affected Versions: Export Post Info plugin versions 1.2.0 and earlier Description: The issue is related to an Authenticated CSV Injection vulnerability. This vulnerability affects the Export Post Info plugin at WordPress, where an authenticated user with author...
CVE-2022-37796
In Simple Online Book Store System 1.0 in /adminbook.php the Title, Author, and Description parameters are vulnerable to Cross Site ScriptingXSS...
CVE-2022-37796
In Simple Online Book Store System 1.0 in /adminbook.php the Title, Author, and Description parameters are vulnerable to Cross Site ScriptingXSS...
Simple Online Book Store System 跨站脚本漏洞
Simple Online Book Store System is a simple online bookstore system by Carlo Montero, an individual developer. A security vulnerability in the Title, Author, and Description parameters of the adminbook.php file in Simple Online Book Store System version 1.0 can be exploited to cause cross-site...
SmartRG Router 2.6.13 Remote Code Execution
Exploit Title: SmartRG Router - Remote Code Execution Date: 13/06/2022 Exploit Author: Yerodin Richards Vendor Homepage: https://adtran.com Version: 2.5.15 / 2.6.13 confirmed Tested on: SR506n 2.5.15 & SR510n 2.6.13 CVE : CVE-2022-37661 import requests from subprocess import Popen, PIPE routerhos...
PT-2022-24074 · Unknown · Simple Online Book Store System
Name of the Vulnerable Software and Affected Versions: Simple Online Book Store System version 1.0 Description: The issue concerns Cross Site Scripting XSS in the /admin book.php file, where the Title, Author, and Description parameters are vulnerable. This allows for potential malicious script...
CVE-2022-2939
The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possible. This is due to improper validation on the value supplied through the 'author' parameter found in the /cerber-load.php file. In...
CVE-2022-2939
The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass in versions up to, and including 9.0, that makes user enumeration possible. This is due to improper validation on the value supplied through the 'author' parameter found in the /cerber-load.php file. In...
PT-2022-19570 · WordPress · Wp Cerber Security
Name of the Vulnerable Software and Affected Versions: WP Cerber Security plugin for WordPress versions up to, and including 9.0 Description: The WP Cerber Security plugin for WordPress is vulnerable to security protection bypass, making user enumeration possible. This is due to improper validati...
History Timeline <= 1.0.5 - Author+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some parameters, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks...
Word Search Puzzles Game <= 2.0.1 - Author+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some parameters, which could allow users with a role as low as author to perform Cross-Site Scripting attacks...
CVE-2022-38812
AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter...
CVE-2022-38812
AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter...
CVE-2022-38812
AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter...
Sql injection
AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter...
CVE-2022-38812
AeroCMS 0.1.1 is vulnerable to SQL Injection via the author parameter...
AeroCMS SQL注入漏洞
AeroCMS is a content management system from AeroCMS Inc. in the United States. A security vulnerability exists in AeroCMS version 0.1.1 that stems from vulnerability to SQL injection attacks via the author parameter...
AeroCMS 0.0.1 SQL Injection
Title: AeroCMS-v0.0.1 SQLi Author: nu11secur1ty Date: 08.27.2022 Vendor: https://github.com/MegaTKC Software: https://github.com/MegaTKC/AeroCMS/releases/tag/v0.0.1 Reference: https://github.com/nu11secur1ty/CVE-nu11secur1ty/tree/main/vendors/MegaTKC/2021/AeroCMS-v0.0.1-SQLi Description: The auth...