Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Venutius BP Profile Shortcodes Extra plugin = 2.5.2 versions...

CVE-2023-47815

CVE-2023-47815 affects the WordPress plugin BP Profile Shortcodes Extra (Venutius) up to version 2.5.2. The vulnerability is Cross-Site Scripting due to improper neutralization of input during web page generation. Patchstack and related sources indicate the fix is to upgrade to 2.5.3 or newer. Th...

PT-2023-30625 · WordPress · Venutius Bp Profile Shortcodes Extra

Name of the Vulnerable Software and Affected Versions: Venutius BP Profile Shortcodes Extra plugin versions = 2.5.2 Description: The issue is related to an Improper Neutralization of Input During Web Page Generation, also known as 'Cross-site Scripting'. This allows for potentially malicious...

WordPress Plugin BP Profile Shortcodes Extra Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress BP Profile Shortcodes Extra Plugin <= 2.5.2 is vulnerable to Cross Site Scripting (XSS)

Software BP Profile Shortcodes Extra Type Plugin Vulnerable versions = 2.5.2 Fixed in 2.5.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-47815 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 426f08e56edb Credits Ngô Thiên An ancorn from...

WordPress Plugin bp-activity-social-share Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress BP WC Vendors Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)

Software BP WC Vendors Type Plugin Vulnerable versions = 1.1.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5c34163fa809 Credits Rafie Muhammad Patchstack Required...

WordPress BP Better Messages Plugin < 2.1.21 is vulnerable to Cross Site Scripting (XSS)

Software BP Better Messages Type Plugin Vulnerable versions 2.1.21 Fixed in 2.1.21 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 144831464a6a Credits Rafie Muhammad Patchstack...

CVE-2023-2704

The BP Social Connect plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 1.5. This is due to insufficient verification on the user being supplied during a Facebook login through the plugin. This makes it possible for unauthenticated attackers to log in a...

CVE-2023-2704

CVE-2023-2704 affects BP Social Connect for WordPress (versions up to and including 1.5) with an authentication bypass due to insufficient verification during Facebook login, enabling unauthenticated login as existing users (e.g., admin) if the attacker has the email. Wordfence notes the vulnerab...

WordPress Plugin BP Social Connect 访问控制错误漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress BP Social Connect Plugin <= 1.5 is vulnerable to Broken Access Control

Software BP Social Connect Type Plugin Vulnerable versions = 1.5 Fixed in 1.6.2 OWASP Top 10 A2: Broken Authentication Classification Broken Access Control CVE CVE-2023-2704 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 7c30551eab88 Credits Lana Codes Required privileg...

CVE-2023-1950

A vulnerability has been found in PHPGurukul BP Monitoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file password-recovery.php of the component Password Recovery. The manipulation of the argument emailid/contactno leads to...

CVE-2023-1948

A vulnerability, which was classified as problematic, has been found in PHPGurukul BP Monitoring Management System 1.0. This issue affects some unknown processing of the file add-family-member.php of the component Add New Family Member Handler. The manipulation of the argument Member Name leads t...

CVE-2023-1949

A vulnerability, which was classified as critical, was found in PHPGurukul BP Monitoring Management System 1.0. Affected is an unknown function of the file change-password.php of the component Change Password Handler. The manipulation of the argument password leads to sql injection. It is possibl...

CVE-2023-1948

A vulnerability, which was classified as problematic, has been found in PHPGurukul BP Monitoring Management System 1.0. This issue affects some unknown processing of the file add-family-member.php of the component Add New Family Member Handler. The manipulation of the argument Member Name leads t...

CVE-2023-1949

A vulnerability, which was classified as critical, was found in PHPGurukul BP Monitoring Management System 1.0. Affected is an unknown function of the file change-password.php of the component Change Password Handler. The manipulation of the argument password leads to sql injection. It is possibl...

Cross site scripting

A vulnerability, which was classified as problematic, has been found in PHPGurukul BP Monitoring Management System 1.0. This issue affects some unknown processing of the file add-family-member.php of the component Add New Family Member Handler. The manipulation of the argument Member Name leads t...

Sql injection

A vulnerability has been found in PHPGurukul BP Monitoring Management System 1.0 and classified as critical. Affected by this vulnerability is an unknown functionality of the file password-recovery.php of the component Password Recovery. The manipulation of the argument emailid/contactno leads to...

CVE-2023-1950

CVE-2023-1950 concerns a SQL injection in the Password Recovery component of PHPGurukul BP Monitoring Management System 1.0, specifically via the file password-recovery.php where manipulating the parameters emailid or contactno enables remote exploitation. Multiple connected sources corroborate t...