1124 matches found
WordPress GS Testimonial Slider plugin <= 3.2.9 - Content Injection vulnerability
Content Injection vulnerability discovered by theviper17 in WordPress Plugin GS Testimonial Slider versions = 3.2.9...
WordPress Wolmart Theme <= 1.8.11 is vulnerable to Content Injection
Software Wolmart Type Theme Vulnerable versions = 1.8.11 Fixed in 1.8.12 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-13793 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 21e712d07197 Credits Lucio Sá Required privilege Unauthenticated...
CVE-2025-0984
Netoloji Software E-Flow is affected (versions before 3.23.00). The vulnerability is an Unrestricted Upload of File with Dangerous Type combined with improper input neutralization during web page generation, enabling Stored XSS and File Content Injection. The issue can allow an attacker to access...
Netoloji E-Flow 代码问题漏洞
Netoloji E-Flow is an application from the Turkish company Netoloji. A code issue vulnerability exists in Netoloji E-Flow versions prior to 3.23.00, which stems from an unrestricted upload of dangerous types of files and improper input neutralization during web page generation, which could lead t...
WordPress LayoutBoxx plugin <= 0.3.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Avraham Shemesh in WordPress Plugin LayoutBoxx versions = 0.3.1...
WordPress Motors Theme <= 5.6.65 is vulnerable to Content Injection
Software Motors Type Theme Vulnerable versions = 5.6.65 Fixed in 5.6.66 OWASP Top 10 A3: Injection Classification Content Injection CVE CVE-2024-13738 Patch priority Medium CVSS severity Medium 7.3 Developer Claim ownership PSID 81285145e079 Credits Lucio Sá Required privilege Unauthenticated...
Cross-Site Scripting (XSS)
github.com/songquanpeng/one-api is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input validation and sanitization of the argument "Homepage Content/About System/Footer.", allows malicious content to be injected and executed in the user's browser...
WordPress Anps Theme plugin plugin <= 1.1.1 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Lucio Sá in WordPress Plugin Anps Theme versions = 1.1.1...
WordPress Form Builder plugin <= 1.2.4 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Avraham Shemesh in WordPress Plugin Form Builder versions = 1.2.4...
WordPress Ocean Extra plugin <= 2.4.6 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by stealthcopter in WordPress Plugin Ocean Extra versions = 2.4.6...
WordPress Sign-up Sheets plugin <= 2.3.0.1 - Shortcode Injection vulnerability
Shortcode Injection vulnerability discovered by Phan Trong Quan - VNPT Cyber Immunity in WordPress Plugin Sign-up Sheets versions = 2.3.0.1...
WordPress Everest Forms plugin <= 3.1.1 - Authenticated (Subscriber+) Arbitrary Shortcode Execution vulnerability
Authenticated Subscriber+ Arbitrary Shortcode Execution vulnerability discovered by mikemyers in WordPress Plugin Everest Forms versions = 3.1.1...
WordPress azurecurve Shortcodes in Comments plugin <= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Avraham Shemesh in WordPress Plugin azurecurve Shortcodes in Comments versions = 2.0.2...
WordPress ORDER POST plugin <= 2.0.2 - Unauthenticated Arbitrary Shortcode Execution vulnerability
Unauthenticated Arbitrary Shortcode Execution vulnerability discovered by Avraham Shemesh in WordPress Plugin ORDER POST versions = 2.0.2...
tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled Default Servlet in Apache Tomcat. For the vulnerability to be...
tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
A flaw was found in Apache Tomcat. In certain conditions and configurations, this vulnerability allows a remote attacker to exploit a path equivalence flaw to view file system contents and add malicious content via a write-enabled Default Servlet in Apache Tomcat. For the vulnerability to be...
