CVE-2023-49444

An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...

CVE-2023-49444

An arbitrary file upload vulnerability in DoraCMS v2.1.8 allow attackers to execute arbitrary code via uploading a crafted HTML or image file to the user avatar...

DoraCMS 安全漏洞

DoraCMS is a software application. Based on Nodejs+eggjs+mongodb to write a content management system . A cross-site scripting XSS vulnerability exists in DoraCMS version v2.1.8. An attacker can exploit this vulnerability to execute arbitrary code by uploading a specially crafted HTML or image fi...

CVE-2023-5884

The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link...

CVE-2023-5884 Word Balloon < 4.20.3 - Avatar Removal via CSRF

The Word Balloon WordPress plugin before 4.20.3 does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link...

WordPress plugin Word Balloon security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability in the WordPress...

PT-2023-32393 · WordPress · Word Balloon

Name of the Vulnerable Software and Affected Versions: Word Balloon WordPress plugin versions prior to 4.20.3 Description: The issue allows an unauthenticated attacker to trick a logged-in user into deleting arbitrary avatars by clicking a link, due to a lack of protection against CSRF attacks in...

CVE-2023-47650

Cross-Site Request Forgery CSRF vulnerability in Peter Sterling Add Local Avatar.This issue affects Add Local Avatar: from n/a through 12.1...

CVE-2023-47650

Cross-Site Request Forgery CSRF vulnerability in Peter Sterling Add Local Avatar.This issue affects Add Local Avatar: from n/a through 12.1...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Peter Sterling Add Local Avatar.This issue affects Add Local Avatar: from n/a through 12.1...

CVE-2023-47650

CVE-2023-47650: The WordPress Add Local Avatar plugin (

CVE-2023-47650 WordPress Add Local Avatar Plugin <= 12.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Peter Sterling Add Local Avatar.This issue affects Add Local Avatar: from n/a through 12.1...

WordPress Plugin Add Local Avatar Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

Word Balloon < 4.20.3 - Avatar Removal via CSRF

Description The plugin does not protect some of its actions against CSRF attacks, allowing an unauthenticated attacker to trick a logged in user to delete arbitrary avatars by clicking a link. Make a logged in admin open...

CVE-2023-46621

A vulnerability in ctltwp User Avatar user-avatar.This issue affects User Avatar: from n/a through = 1.4.11...

CVE-2023-46621

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin = 1.4.11 versions...

CVE-2023-46621

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin = 1.4.11 versions...

CVE-2023-46621 WordPress User Avatar Plugin <= 1.4.11 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin = 1.4.11 versions...

CVE-2023-46621 WordPress User Avatar Plugin <= 1.4.11 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Enej Bajgoric / Gagan Sandhu / CTLT DEV User Avatar plugin = 1.4.11 versions...

CVE-2023-46621

CVE-2023-46621 is an unauthenticated cross-site scripting (XSS) vulnerability in the WordPress plugin User Avatar (ctltwp User Avatar) affecting versions up to and including 1.4.11 . The issue has a published CVE and is mitigated by upgrading to 1.4.12 or later. PatchStack corroborates the vulner...