7655 matches found
CVE-2022-4668
CVE-2022-4668 affects the Easy Appointments WordPress plugin (versions before 3.11.2). The issue is that shortcode attributes are not validated/escaped before output, enabling Stored Cross‑Site Scripting by users with as little as a contributor against high‑privilege users (e.g., admins). A PoC e...
CVE-2022-4668 Easy Appointments < 3.11.2 - Contributor+ Stored XSS in Shortcode
The Easy Appointments WordPress plugin before 3.11.2 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...
PT-2023-14989 · WordPress · Easyappointments
Name of the Vulnerable Software and Affected Versions: Easy Appointments WordPress plugin versions prior to 3.11.2 Description: The issue concerns a lack of validation and escaping of some shortcode attributes, which could allow users with a role as low as contributor to perform Stored Cross-Site...
CVE-2023-24096
CVE-2023-24096 affects TrendNet Wireless AC Easy-Upgrader TEW-820AP (v1.0R, firmware 1.01.B01). The issue is a stack overflow in the /formPasswordSetup endpoint triggered by the newpass parameter, enabling arbitrary code execution. The vulnerability targets devices no longer supported by the main...
CVE-2023-24099
The CVE-2023-24099 issue affects TrendNet Wireless AC Easy-Upgrader TEW-820AP (v1.0R, firmware 1.01.B01). The vulnerability is a stack overflow exploitable through the username parameter in the /formWizardPassword endpoint, enabling arbitrary code execution. Affected devices are noted as no longe...
CVE-2022-47065
CVE-2022-47065 : A stack overflow exists in TrendNet Wireless AC Easy-Upgrader TEW-820AP (v1.0R, firmware 1.01.B01) triggered by the submit-url parameter at the /formNewSchedule endpoint. The vulnerability allows arbitrary code execution and is noted to affect products no longer supported by the ...
CVE-2023-24099
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the username parameter at /formWizardPassword. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects...
CVE-2023-24097
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formPasswordAuth. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects...
WordPress plugin The Easy Appointments 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2023-24095
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formSystemCheck. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects...
PT-2023-14545 · WordPress · Easy Social Feed
Name of the Vulnerable Software and Affected Versions: Easy Social Feed WordPress plugin versions prior to 6.4.0 Description: The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as admin, du...
CVE-2023-24096
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the newpass parameter at /formPasswordSetup. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects...
CVE-2023-24097
CVE-2023-24097 affects TrendNet Wireless AC Easy-Upgrader TEW-820AP (v1.0R, firmware 1.01.B01). Root cause: a stack overflow in the /formPasswordAuth endpoint via the submit-url parameter, leading to arbitrary code execution. Cvss3.1 base score 8.8 (HIGH) with network attack vector, low complexit...
CVE-2022-47065
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formNewSchedule. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects...
WordPress plugin The Easy Bootstrap Shortcode 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2023-24096
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the newpass parameter at /formPasswordSetup. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects...
CVE-2023-24098
TrendNet Wireless AC Easy-Upgrader TEW-820AP v1.0R, firmware version 1.01.B01 was discovered to contain a stack overflow via the submit-url parameter at /formSysLog. This vulnerability allows attackers to execute arbitrary code via a crafted payload. NOTE: This vulnerability only affects products...
WordPress plugin Easy Social Feed 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2023-24098
The CVE-2023-24098 entry affects TrendNet Wireless AC Easy-Upgrader TEW-820AP (v1.0R, firmware 1.01.B01). A stack overflow via the submit-url parameter at /formSysLog allows arbitrary code execution. The affected devices are no longer supported by the maintainer. Public details confirm the vulner...
