1855 matches found
WordPress plugin code injection vulnerability (CNVD-2021-52420)
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . A code injection vulnerability exists in WordPress Plugin...
Cross site scripting
The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a...
CVE-2021-24434 Glass <= 1.3.2 - CSRF to Stored Cross-Site Scripting (XSS)
The Glass WordPress plugin through 1.3.2 does not sanitise or escape its "Glass Pages" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin did not have CSRF check in place when saving its settings, allowing the issue to be exploited via a...
CVE-2021-24405
The Easy Cookies Policy WordPress plugin through 1.6.2 is lacking any capability and CSRF check when saving its settings, allowing any authenticated users such as subscriber to change them. If users can't register, this can be done through CSRF. Furthermore, the cookie banner setting is not...
Instantio < 1.2.6 - CSRF Bypass
The plugin did not properly check for CSRF in its wivariableproductquickview AJAX action, allowing attacker to make user call it via a CSRF attack...
Migrate Users <= 1.0.1 - CSRF to Stored Cross-Site Scripting (XSS)
The plugin does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack. PoC Add the following...
CVE-2020-35759
bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content Locally/Remotely...
CVE-2020-35759
bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content Locally/Remotely...
CVE-2020-35759
bloofoxCMS 0.5.2.1 is infected with a CSRF Attack that leads to an attacker editing any file content Locally/Remotely...
CVE-2020-35759
The provided connected documents confirm a CSRF vulnerability in bloofoxCMS 0.5.2.1 that permits an attacker to edit the content of any file. This is described consistently across CVE-2020-35759 records (NVD entry and CNVD/CNNVD variants) as a cross-site request forgery flaw in bloofoxCMS 0.5.2.1...
Cross site request forgery (csrf)
A flaw was found in Infinispan version 10, where it is possible to perform various actions that could have side effects using GET requests. This flaw allows an attacker to perform a cross-site request forgery CSRF attack...
CVE-2021-32096
The ConsoleAction component of U.S. National Security Agency NSA Emissary 5.9.0 allows a CSRF attack that results in injecting arbitrary Ruby code for an eval call via the CONSOLECOMMANDSTRING parameter...
CVE-2021-32096
CVE-2021-32096 affects NSA Emissary 5.9.0 — the ConsoleAction component is vulnerable to a CSRF attack that results in injecting arbitrary Ruby code (via an eval call) through the CONSOLE_COMMAND_STRING parameter. This is the stated impact in the CVE entry. The connected documents also corroborat...
CVE-2021-24254 College Publisher Import <= 0.1 - Arbitrary File Upload to RCE
The College publisher Import WordPress plugin through 0.1 does not check for the uploaded CSV file to import, allowing high privilege users to upload arbitrary files, such as PHP, leading to RCE. Due to the lack of CSRF check, the issue could also be exploited via a CSRF attack...
CVE-2020-36334
themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database...
Parcel Tracker eCourier < 1.0.2 - Plugin's Settings Update via CSRF
The plugin did not properly check for CSRF, allowing attackers to make a logged in administrator update the plugin's settings...
PHPFusion < 9.03.100 Multiple Vulnerabilities
PHPFusion is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
CVE-2021-31584
Sipwise C5 NGCP wwwcsc version 3.6.4 up to and including platform NGCP CE mr3.8.13 allows call/click2dial CSRF attacks for actions with administrative privileges...
