CVE-2023-3226

The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-3226

The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-3226

CVE-2023-3226 affects the Popup Builder WordPress plugin, prior to version 4.2.0. The issue arises from insufficient sanitization/escaping of several settings, enabling Stored Cross-Site Scripting by high-privilege users (e.g., admins), even when unfiltered_html is disallowed (multisite contexts)...

CVE-2023-3226 Popup Builder < 4.2.0 - Admin+ Stored Cross-Site Scripting

The Popup Builder WordPress plugin before 4.2.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress iPanorama 360 WordPress Virtual Tour Builder Plugin < 1.8.0 is vulnerable to SQL Injection

Software iPanorama 360 WordPress Virtual Tour Builder Type Plugin Vulnerable versions 1.8.0 Fixed in 1.8.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE N/A Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID fc24718ff856 Credits Unknown Required privilege...

PageLayer < 1.7.8 - Author+ Stored XSS

Description The plugin doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code. - As a user with Author+ capabilities, create a new post draft - Save it, then edit it using the PageLayer page builder - Navigate to the...

WordPress plugin Popup Builder cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PageLayer < 1.7.8 - Author+ Stored XSS

Description The plugin doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code. PoC - As a user with Author+ capabilities, create a new post draft - Save it, then edit it using the PageLayer page builder - Navigate to...

PageLayer < 1.7.7 - Unauthenticated Stored XSS

Description The plugin doesn't prevent unauthenticated attackers from updating a post's header or footer code on scheduled posts. PoC Unauthenticated attacker Proof of Concept 1 As a legitimate administrator, schedule a post to be published in a few minutes. 2 Close every window to that site to...

PT-2023-23685 · WordPress · Popup Builder

Name of the Vulnerable Software and Affected Versions: Popup Builder WordPress plugin versions prior to 4.2.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This can occur even when the unfiltered html capability is disallowed,...

WordPress Colibri Page Builder Plugin < 1.0.229 SQLi Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:extendthemes:colibripagebuilder"; if description...

The vulnerability of the software for controlling protection devices and monitoring power systems, SEL-5036 acSELerator Bay Screen Builder, is related to deficiencies in path name limitation. This allows attackers to access confidential information.

The vulnerability of the software for controlling protection devices and monitoring power systems, SEL-5036 acSELerator Bay Screen Builder, is related to deficiencies in path name limitation. Exploiting this vulnerability can allow a malicious actor to gain access to confidential information...

CVE-2023-42454

SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection string specified in the sqlpage/sqlpage.json configuration file not in an environment variable, with the webroot is the current working...

Design/Logic Flaw

SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection string specified in the sqlpage/sqlpage.json configuration file not in an environment variable, with the webroot is the current working...

CVE-2023-42454 SQLpage vulnerable to public exposure of database credentials

SQLpage is a SQL-only webapp builder. Someone using SQLpage versions prior to 0.11.1, whose SQLpage instance is exposed publicly, with a database connection string specified in the sqlpage/sqlpage.json configuration file not in an environment variable, with the webroot is the current working...

CVE-2023-42454

SQLpage CVE-2023-42454 affects versions before 0.11.1 where an exposed SQLPage instance stores the database connection string in sqlpage/sqlpage.json and the web_root is the default, allowing an attacker who can access the instance and the database to retrieve credentials and connect directly. Th...

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing lies in the possibility of an operation exceeding the buffer boundaries in memory, allowing a hacker to execute arbitrary code.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing is related to the execution of operations beyond the buffer boundaries in memory when processing WRL format files. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading...

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing lies in the possibility of an operation exceeding the buffer boundaries in memory, allowing a hacker to execute arbitrary code.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing is related to the execution of operations beyond the buffer boundaries in memory when processing WRL and PLY format files. Exploiting this vulnerability allows an attacker to execute arbitrary code by...

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing lies in the possibility of an operation exceeding the buffer boundaries in memory, allowing a hacker to execute arbitrary code.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing is related to the execution of operations beyond the buffer boundaries in memory when processing PLY format files. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading...

The vulnerability of the 3D Builder software, related to the execution of operations beyond the buffer in memory, allows an attacker to execute arbitrary code.

The vulnerability of the 3D Builder software for designing and preparing objects for 3D printing is related to the execution of operations beyond the buffer boundaries in memory when processing GLB files. Exploiting this vulnerability allows an attacker to execute arbitrary code by loading a...