1994 matches found
GHSA-4R8C-PJ7X-M5JX Comments plugin Cross-Site Request Forgery (CSRF)
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. CSRF affects comment integrity...
Comments plugin stored Cross-site Scripting via a guest name
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via a guest name...
GHSA-69WW-WV3J-MHG4 Comments plugin stored Cross-site Scripting (XSS) via an asset volume name
An issue was discovered in the Comments plugin before 1.5.5 for Craft CMS. There is stored XSS via an asset volume name...
Knock Knock plugin Open redirection vulnerability
The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection...
GHSA-M69R-4H68-XQ7J Knock Knock plugin Open redirection vulnerability
The Knock Knock plugin before 1.2.8 for Craft CMS allows malicious redirection...
GHSA-WXVR-QQM7-6H65 Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header...
Knock Knock plugin IP Whitelist bypass via an X-Forwarded-For HTTP header
The Knock Knock plugin before 1.2.8 for Craft CMS allows IP Whitelist bypass via an X-Forwarded-For HTTP header...
Image Resizer Cross-site Scripting (XSS) in the Bulk Resize action
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...
GHSA-P7RM-GH9G-5FR8 Image Resizer Cross-site Scripting (XSS) in the Bulk Resize action
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There is stored XSS in the Bulk Resize action...
Image Resizer Cross-Site Request Forgery (CSRF)
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...
GHSA-5V5Q-3M7M-97J7 Image Resizer Cross-Site Request Forgery (CSRF)
An issue was discovered in the Image Resizer plugin before 2.0.9 for Craft CMS. There are CSRF issues with the log-clear controller action...
Craft CMS possibility of brute force attempts
In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
GHSA-WVR4-W6CW-4PX8 Craft CMS possibility of brute force attempts
In Craft CMS before 3.1.7, the elevated session password prompt was not being rate limited like normal login forms, leading to the possibility of a brute force attempt on them...
Craft CMS XSS Vulnerability
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...
GHSA-F3XR-Q258-H7M9 Craft CMS XSS Vulnerability
Craft CMS before 3.3.8 has stored XSS via a name field. This field is mishandled during site deletion...
Craft CMS XSS Vulnerability
Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS...
GHSA-W5Q4-Q7WP-QWW6 Craft CMS XSS Vulnerability
Craft CMS before 3.1.31 does not properly filter XML feeds, thus allowing XSS...
Craft CMS XSS Vulnerability
Craft CMS before 2.6.2974 allows XSS attacks...