PT-2022-26477 · Google · Android Kernel

Name of the Vulnerable Software and Affected Versions: Android kernel Description: The issue is related to a possible out of bounds read in the ProtocolSimBuilderLegacy::BuildSimGetGbaAuth function due to a missing bounds check. This could lead to local information disclosure, requiring System...

iPanorama 360 WordPress Virtual Tour Builder < 1.6.30 - Contributor+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow users such as contributor+ to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC 1. Create a new panorama item with whatever role, even if it's an Administrator. 2...

CVE-2022-3906

The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3906

The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3906

CVE-2022-3906 concerns the WordPress plugin Easy Form Builder prior to version 3.4.0 . The root cause is incomplete sanitisation/escaping of some settings, enabling stored XSS by high-privilege users (e.g., admins), even when the unfiltered_html capability is disallowed (such as in multisite envi...

CVE-2022-3906 Easy Form Builder < 3.4.0 - Admin+ Stored XSS

The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

PT-2022-24704 · WordPress · Easy Form Builder

Name of the Vulnerable Software and Affected Versions: Easy Form Builder WordPress plugin versions prior to 3.4.0 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks. This is possible because some settings are not properly sanitised a...

WordPress plugin Easy Form Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

AyaCMS 注入漏洞

AyaCMS is an extremely simple and free open source PHP website builder. A security vulnerability exists in AyaCMS version 3.1.2, which stems from vulnerability to Remote Code Execution RCE attacks...

CVE-2022-3830

The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3830

The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The WP Page Builder WordPress plugin through 1.2.8 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3830

The CVE-2022-3830 issue affects WP Page Builder

PT-2022-24350 · WordPress · Wp Page Builder

Name of the Vulnerable Software and Affected Versions: WP Page Builder versions 1.2.8 and earlier Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for example in multisite...

WordPress plugin WP Page Builder 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2022-41158

Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code...

Remote code execution

Remote code execution vulnerability can be achieved by using cookie values as paths to a file by this builder program. A remote attacker could exploit the vulnerability to execute or inject malicious code...

PT-2022-25687 · Eyoom Co. +1 · Eyoom Builder

Name of the Vulnerable Software and Affected Versions: Builder program affected versions not specified Description: The issue allows for remote code execution by utilizing cookie values as paths to a file. This can be exploited by a remote attacker to execute or inject malicious code...

CVE-2022-41158

Eyoom Builder (Eyoom) contains a path traversal/remote code execution flaw. Affects versions prior to 4.5.4; vulnerability arises from using cookie values as file paths, enabling remote attackers to execute or inject code. Reported across multiple feeds (CNNVD/CVE entries). Remediation cited: upd...