110406 matches found
Flyte Admin SQL Injection in List Filters
Impact List endpoints on Flyte Admin has a SQL vulnerability where a malicious user can send a REST requests with custom SQL statements as list filters. Workarounds The attacker needs to have access to the flyteadmin installation typically either behind a VPN or authentication. References...
GHSA-R847-6W6H-R8G4 Flyte Admin SQL Injection in List Filters
Impact List endpoints on Flyte Admin has a SQL vulnerability where a malicious user can send a REST requests with custom SQL statements as list filters. Workarounds The attacker needs to have access to the flyteadmin installation typically either behind a VPN or authentication. References...
CVE-2023-46194
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...
CVE-2023-46194 WordPress Archivist – Custom Archive Templates Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...
CVE-2023-46194 WordPress Archivist – Custom Archive Templates Plugin <= 1.7.5 is vulnerable to Cross Site Scripting (XSS)
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...
CVE-2023-46194
CVE-2023-46194 – Unauthenticated Reflected XSS in Archivist – Custom Archive Templates (WordPress)
CVE-2023-46816: Improper Control of Generation of Code
An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. A Server Site Template Injection SSTI vulnerability has been identified in the GecControl action. By using a crafted request, custom PHP code can be injected via the GetControl action because of missing input validation. A...
PT-2023-30037 · Unknown · Juzawebcms
Name of the Vulnerable Software and Affected Versions: juzawebCMS versions 3.4 and earlier Description: An issue in the software allows a remote attacker to execute arbitrary code via a crafted file to the custom plugin function. This enables the attacker to potentially gain control over the...
Custom post types <= 5.0.0 - Admin+ Stored XSS
Description The plugin does not validate and escape some parameters, which could allow users with the admin role and above to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
Archivist – Custom Archive Templates <= 1.7.5 - Reflected XSS
Description The plugin does not sanitise and escape some parameters before outputting them back in the page, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-46194: Improper Neutralization of Input During Web Page Generation
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Eric Teubert Archivist – Custom Archive Templates plugin = 1.7.5 versions...
CVE-2023-46815: Unrestricted Upload of File with Dangerous Type
An issue was discovered in SugarCRM 12 before 12.0.4 and 13 before 13.0.2. An Unrestricted File Upload vulnerability has been identified in the Notes module. By using a crafted request, custom PHP code can be injected via the Notes module because of missing input validation. An attacker with...
CVE-2023-46077
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...
CVE-2023-32116
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin = 4.0.12 versions...
CVE-2023-32116
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin = 4.0.12 versions...
CVE-2023-46077
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...
Cross site scripting
Unauth. Reflected Cross-Site Scripting XSS vulnerability in Arrow Plugins The Awesome Feed – Custom Feed plugin = 2.2.5 versions...
Cross site scripting
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in TotalPress.Org Custom post types, Custom Fields & more plugin = 4.0.12 versions...
CVE-2023-32116
CVE-2023-32116 affects the WordPress plugin “TotalPress.Org Custom post types, Custom Fields & more” (versions <= 4.0.12). The root cause is an authenticated stored XSS vulnerability exploitable by users with admin+ privileges; the impact is stored script execution within the plugin’s context ...