CVE-2023-0548 Namaste! LMS < 2.5.9.4 - Admin+ Stored XSS

The Namaste! LMS WordPress plugin before 2.5.9.4 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-0166 PickPlugins Product Slider for WooCommerce < 1.13.42 - Contributor+ Stored XSS

The Product Slider for WooCommerce by PickPlugins WordPress plugin before 1.13.42 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored...

Olevmedia Shortcodes <= 1.1.9 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC button style='"...

cognitionmath.com Cross Site Scripting vulnerability OBB-3131243

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Security Bulletin: Vulnerabilities in PostgreSQL, Node.js, and Data Tables from Spry Media may affect IBM Spectrum Protect Plus

Summary Vulnerabilities in PostgreSQL, Node.js, and Data Tables from Spry Media such as SQL injection, HTTP request smuggling, cross-site scripting, bypass of security restrictions, and weaker than expected security, may affect IBM Spectrum Protect Plus. Vulnerability Details CVEID: CVE-2021-2321...

SUSE: Security Advisory (SUSE-SU-2015:1044-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2021 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

fotoslesvianas.com.ar Cross Site Scripting vulnerability OBB-1482991

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

mwlaw.co.kr Cross Site Scripting vulnerability OBB-1454001

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

temma.gr Cross Site Scripting vulnerability OBB-1335924

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

SportsPress < 2.7.2 - Authenticated Stored Cross-Site Scripting

Any user with the role of administrator or League Manager is able to store XSS payloads in the custom delimiter setting of events pages. This will then execute on all events pages on the website. Video PoC: https://youtu.be/J8QZ8S6CiS8...

tu-chemnitz.de Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-1138337 Security Researcher ELProfesor Helped patch 2791 vulnerabilities Received 8 Coordinated Disclosure badges Received 106 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting tu-chemnitz.de website...

Newspaper Theme < 9.5 - Cross-Site Scripting (XSS)

Description From the changelog: Newspaper - Version: 9.2.2 fix: XSS Security issue...

WordPress Gwolle Guestbook 2.5.3 Cross Site Scripting

DefenseCode ThunderScan SAST Advisory: WordPress Gwolle Guestbook Plugin XSS Security Vulnerability Advisory ID: DC-2018-05-008 Advisory Title: WordPress Gwolle Guestbook Plugin XSS Security Vulnerability Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Gwolle Guestbook...

autowereld.nl XSS vulnerability

Open Bug Bounty ID: OBB-459705 Description| Value ---|--- Affected Website:| autowereld.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

nl.yakult.be XSS vulnerability

Open Bug Bounty ID: OBB-154430 Description| Value ---|--- Affected Website:| nl.yakult.be Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

Yeager CMS 1.2.1 - Multiple Vulnerabilities

Exploit for php platform in category web applications title: Multiple Vulnerabilities product: Yeager CMS vulnerable version: 1.2.1 fixed version: 1.3 CVE number: CVE-2015-7567, CVE-2015-7568, CVE-2015-7569, CVE-2015-7570 , CVE-2015-7571, CVE-2015-7572 impact: Critical homepage:...

WordPress Sender 0.7 Cross Site Scripting

Plugin Name : Sender Effected Version : 0.7 and most probably lower version's if any Vulnerability : A3-Cross-Site Scripting XSS Identified by : Madhu Akula Technical Details Minimum Level of Access Required : Administrator PoC - Proof of Concept : The following fields put the payload as below...

0101SHOP CMS 商城模板存在SQL注入漏洞

CMS在处理浏览器提交的数据时使用filterPara函数过滤，这个函数接着调用了PreventSqlin和Checkxss两个函数进行字符过滤，PreventSqlin用来过滤SQL注入语句，而Checkxss是用来过滤跨站输入。 关键就是在PreventSqlin函数 /inc/AspCmsCommonFun.asp 函数内容如下： Function preventSqlincontent dim sqlStr,sqlArray,i,speStr...

Mozilla Firefox Multiple Vulnerabilities-01 (Dec 2013) - Mac OS X

Mozilla Firefox is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:mozilla:firefox";...

Fixed XSS vulnerability at www.flyfishinginmaine.com

Security researcher jokers, has submitted on 20/02/2012 a cross-site-scripting XSS vulnerability affecting www.flyfishinginmaine.com, which at the time of submission ranked 8234134 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 10/03/2015. It ...