CVE-2023-4161

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can tric...

CVE-2023-4315

CVE-2023-4315 affects the WordPress plugin “Woo Custom Emails”. The vulnerability is a reflected XSS in the wcemails_edit parameter for versions up to and including 2.2, caused by insufficient input sanitization and output escaping. Exploitation requires user interaction (tricking the user into c...

CVE-2023-4315 Woo Custom Emails <= 2.2 - Reflected Cross-Site Scripting via wcemails_edit

The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemailsedit' parameter in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2023-4161 WooCommerce PDF Invoice Builder <= 1.2.90 - Cross-Site Request Forgery to Custom Field Creation

The WooCommerce PDF Invoice Builder for WordPress is vulnerable to Cross-Site Request Forgery due to a missing nonce check on the SaveCustomField function in versions up to, and including, 1.2.90. This makes it possible for unauthenticated attackers to create invoice fields provided they can tric...

CVE-2023-4315: Improper Neutralization of Input During Web Page Generation

The Woo Custom Emails for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'wcemailsedit' parameter in versions up to, and including, 2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

WordPress plugin Woo Custom Emails 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

knispelcustomcarpentryinc.com Cross Site Scripting vulnerability OBB-3627591

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-32740

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kunal Nagar Custom 404 Pro plugin = 3.8.1 versions...

CVE-2023-32740

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kunal Nagar Custom 404 Pro plugin = 3.8.1 versions...

Cross site scripting

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kunal Nagar Custom 404 Pro plugin = 3.8.1 versions...

CVE-2023-32740 WordPress Custom 404 Pro Plugin <= 3.8.1 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kunal Nagar Custom 404 Pro plugin = 3.8.1 versions...

CVE-2023-32740 WordPress Custom 404 Pro Plugin <= 3.8.1 is vulnerable to Cross Site Scripting (XSS)

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kunal Nagar Custom 404 Pro plugin = 3.8.1 versions...

WordPress plugin Custom 404 Pro 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2023-32740: Improper Neutralization of Input During Web Page Generation

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Kunal Nagar Custom 404 Pro plugin = 3.8.1 versions...

PT-2023-27498 · Unknown · Skylark App For Android +1

Name of the Vulnerable Software and Affected Versions: Skylark App for Android versions 6.2.13 and earlier Skylark App for iOS versions 6.2.13 and earlier Description: The issue is related to improper authorization in the handler for a custom URL scheme, allowing an attacker to lead a user to...

CVE-2023-40530: Missing Authorization

Improper authorization in handler for custom URL scheme issue in 'Skylark' App for Android 6.2.13 and earlier and 'Skylark' App for iOS 6.2.13 and earlier allows an attacker to lead a user to access an arbitrary website via another application installed on the user's device...

"Skylark" App fails to restrict custom URL schemes properly

Overview "Skylark" App provided by SKYLARK HOLDINGS CO., LTD. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-939, CVE-2023-40530, CVE-2024-54014 which may be exploited to direct the App to access any sites...

Skylark Holdings Skylark App 安全漏洞

Skylark Holdings Skylark App is a mobile application from Skylark Holdings, a Japanese company. A security vulnerability exists in the Skylark Holdings Skylark App that stems from a custom URL access feature that is not properly restricted...

JVN#03447226: "Skylark" App fails to restrict custom URL schemes properly

"Skylark" App provided by SKYLARK HOLDINGS CO., LTD. provides the function to access a requested URL using Custom URL Scheme. The App does not restrict access to the function properly CWE-939, CVE-2023-40530, CVE-2024-54014 which may be exploited to direct the App to access any sites. Impact An...

CVE-2023-40177

XWiki Platform is a generic wiki platform offering runtime services for applications built on top of it. Any registered user can use the content field of their user profile page to execute arbitrary scripts with programming rights, thus effectively performing rights escalation. This issue is...