CVE-2023-26012

CVE-2023-26012 is a stored XSS vulnerability in the WordPress plugin “Denzel Chia | Phire Design Custom Login Page” (plugin versions ≤ 2.0). The issue requires admin+ privileges and authenticating to trigger a stored XSS vector, potentially affecting site integrity via user input handling. Public...

Researchers Uncover New Exploit for PaperCut Vulnerability That Can Bypass Detection

Cybersecurity researchers have found a way to exploit a recently disclosed critical flaw in PaperCut servers in a manner that bypasses all current detections. Tracked as CVE-2023-27350 CVSS score: 9.8, the issue affects PaperCut MF and NG installations that could be exploited by an unauthenticate...

Advanced Custom Fields < 6.1.6 - Reflected XSS

The plugins do not escape the poststatus parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open...

WordPress plugin Design Custom Login Page 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

CVE-2023-26012: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Denzel Chia | Phire Design Custom Login Page plugin = 2.0 versions...

CVE-2023-23790

Cross-Site Request Forgery CSRF vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin = 2.9.10.2 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin = 2.9.10.2 versions...

CVE-2023-23790 WordPress Pods Plugin <= 2.9.10.2 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin = 2.9.10.2 versions...

Arbitrary Code Execution

jena-arq is vulnerable to Arbitrary Code Execution. The vulnerability exists due to the insufficient validation of user scripting queries in the library, which allows an attacker to inject and execute malicious JavaScript via a SPARQL query when invoking custom scripts...

Malicious code in spring-boot-admin-virgil-custom-ui (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bf3bf8c73b2a5a04555aa1692341d9861a37ad32f428b123c88751322e74c66d Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

How to Retain the Custom Settings Made to NetScaler Appliance after the Restart

This article contains information about retaining the customer settings you have made to the NetScaler or Access Gateway Enterprise Edition appliance after the appliance is restarted. When you restart the NetScaler or Access Gateway Enterprise Edition appliance, the appliance automatically copies...

CVE-2023-23790: Cross-Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Pods Framework Team Pods – Custom Content Types and Fields plugin = 2.9.10.2 versions...

PT-2023-6577 · WordPress · Custom 404 Pro

Name of the Vulnerable Software and Affected Versions: Custom 404 Pro versions prior to 3.7.3 Description: The issue is related to the Custom 404 Pro WordPress plugin, which does not properly escape some URLs before outputting them in attributes. This can lead to Reflected Cross-Site Scripting,...

CVE-2023-1196

The Advanced Custom Fields ACF Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present...

Design/Logic Flaw

The Advanced Custom Fields ACF Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present...

CVE-2023-1196 Advanced Custom Fields - Contributor+ PHP Object Injection

The Advanced Custom Fields ACF Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present...

CVE-2023-1196 Advanced Custom Fields - Contributor+ PHP Object Injection

The Advanced Custom Fields ACF Free and Pro WordPress plugins 6.x before 6.1.0 and 5.x before 5.12.5 unserialize user controllable data, which could allow users with a role of Contributor and above to perform PHP Object Injection when a suitable gadget is present...

CVE-2023-1614

The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-1614 WP Custom Author URL < 1.0.5 - Admin+ Stored XSS

The WP Custom Author URL WordPress plugin before 1.0.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2023-1614

CVE-2023-1614 affects the WordPress plugin WP Custom Author URL (pre-1.0.5). The vulnerability stems from insufficient sanitization/escaping of certain plugin settings, enabling Stored Cross-Site Scripting by high-privilege users (e.g., admins) even when unfiltered_html is disallowed. Public deta...