5274 matches found
CVE-2024-26484
A stored cross-site scripting XSS vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link field. NOTE: the vendor's position is that this issue did not affect any version of Kirby CM...
CVE-2023-28170
Unrestricted Upload of File with Dangerous Type vulnerability in Themely Theme Demo Import.This issue affects Theme Demo Import: from n/a through 1.1.1...
CVE-2023-27088
feiqu-opensource Background Vertical authorization vulnerability exists in IndexController.java. demo users with low permission can perform operations within the permission of the admin super administrator and can use this vulnerability to change the blacklist IP address in the system at will...
CVE-2023-2279
The WP Directory Kit plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.1. This is due to missing or incorrect nonce validation on the 'adminpagedisplay' function. This makes it possible for unauthenticated attackers to delete or change plugin...
MAL-2025-4343 Malicious code in event-sharing-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13f49cdbe899b99a1893c1bbba29d21d1f5b38fb841d0e2b297c9ed7c4f974b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in event-sharing-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 13f49cdbe899b99a1893c1bbba29d21d1f5b38fb841d0e2b297c9ed7c4f974b0 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in sfc-demo (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 1666178bc834e0e4ff1cf9d99b642c7dfd6d9d279154ad62cd32762c7797e037 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
CVE-2022-1504
XSS in /demo/module/?module=HERE in GitHub repository microweber/microweber prior to 1.2.15. Typical impact of XSS attacks...
CVE-2022-1008
The One Click Demo Import WordPress plugin before 3.1.0 does not validate the imported file, allowing high privilege users such as admin to upload arbitrary files such as PHP even when FILEMODS and FILEEDIT are disallowed...
CVE-2020-36334
themegrill-demo-importer before 1.6.3 allows CSRF, as demonstrated by wiping the database...
CVE-2020-10118
cPanel before 84.0.20 allows a demo account to modify files via Branding API calls SEC-543...
CVE-2020-10119
cPanel before 84.0.20 allows a demo account to achieve remote code execution via a cpsrvd rsync shell SEC-544...
CVE-2020-36333
themegrill-demo-importer before 1.6.2 does not require authentication for wiping the database, because of a resetwizardactions hook...
Malicious code in calling-extensions-sdk-demo-minimal-js (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2025-4218 Malicious code in evillib-cli-demo (PyPI)
--- -= Per source details. Do not edit below this line.=-...
Malicious code in evillib-cli-demo (PyPI)
--- -= Per source details. Do not edit below this line.=-...
CVE-2010-2276
The default configuration of the build process in Dojo 0.4.x before 0.4.4, 1.0.x before 1.0.3, 1.1.x before 1.1.2, 1.2.x before 1.2.4, 1.3.x before 1.3.3, and 1.4.x before 1.4.2 has the copyTests=true and mini=false options, which makes it easier for remote attackers to have an unspecified impact...
CVE-2017-18436
cPanel before 64.0.21 allows demo accounts to read files via a Fileman::getfileactions API2 call SEC-239...