Request a Quote <= 2.3.7 - CSV Injection

The plugin does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it PoC On a page with a Quote Request form, upload the following CSV as an attachment: "First Name","Last...

Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site Scripting

The plugin does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/admin.php?page=advanceddbcleanertab=croncat=all&" Other pages are affected...

Download Manager < 3.2.44 - Reflected Cross-Site Scripting

The plugin does not escape a generated URL before outputting it back in an attribute of the history dashboard, leading to Reflected Cross-Site Scripting PoC https://example.com/wp-admin/edit.php?posttype=wpdmpro=wpdm-stats=historyids=1&"...

CVE-2022-30120

XSS in /dashboard/blocks/stacks/viewdetails/ - old browsers only. When using an older browser with built-in XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2 to allow XSS. This cannot...

CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

CVE-2022-30119

XSS in /dashboard/reports/logs/view - old browsers only. When using Internet Explorer with the XSS protection disabled, insufficient sanitation where built urls are outputted can be exploited for Concrete 8.5.7 and below as well as Concrete 9.0 through 9.0.2. This cannot be exploited in modern-da...

CVE-2017-20092

A vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched remotely...

CVE-2017-20092 Google Analytics Dashboard Plugin cross site scriting

A vulnerability classified as problematic was found in Google Analytics Dashboard Plugin 2.1.1. Affected by this vulnerability is an unknown functionality. The manipulation leads to basic cross site scripting. The attack can be launched remotely...

CVE-2017-20092

The CVE-2017-20092 entry concerns the Google Analytics Dashboard Plugin version 2.1.1 for WordPress. The available description states that an unknown functionality is vulnerable to manipulation that leads to basic cross-site scripting (XSS), with remote attack capability. Connected sources consis...

PortlandLabs Concrete CMS 跨站脚本漏洞

PortlandLabs Concrete CMS is a team-oriented open source content management system from PortlandLabs, Inc. A cross-site scripting vulnerability exists in PortlandLabs Concrete CMS, which originates from a lack of data validation filtering of user-supplied data and output in...

WordPress Plugin Google Analytics Dashboard 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Plugin Google Analytics Dashboard version 2.1.1 is vulnerable to a cross-site scripting...

Malicious Package

Overview @law-functions/dashboard is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if this...

Malicious code in 18f-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2fb047b79df818c0c5d0f2f262bfbdca93a4c550b863e5ee9d4f9ddb7ad99f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-19 Malicious code in 18f-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware b2fb047b79df818c0c5d0f2f262bfbdca93a4c550b863e5ee9d4f9ddb7ad99f8 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6989 Malicious code in vue-cumulio-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8eeefaf68101f349819d84bdae72da14d6b359af0dbb52cd27b8063eff3f621 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in vue-cumulio-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware f8eeefaf68101f349819d84bdae72da14d6b359af0dbb52cd27b8063eff3f621 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in streamer-market-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6c6f1e291b3a5d435c62a8477ffbbb7e62e15250973dd23955f3bea0baff557 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2022-6323 Malicious code in streamer-market-dashboard (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware e6c6f1e291b3a5d435c62a8477ffbbb7e62e15250973dd23955f3bea0baff557 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in now-dashboard-analyze (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04c9c4dd295653d2e1a589fc80610b6a7d3817ca684ac34f8748ecc73073e3e7 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...