11667 matches found
CVE-2023-48912
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/edit...
CVE-2023-48912
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/edit...
CVE-2023-48912
Dreamer CMS v4.1.3 contains a Cross-Site Request Forgery (CSRF) vulnerability in the /admin/archives/edit component. The CVE entry ties the issue to Dreamer CMS and specifies CSRF as the flaw, but the provided documents do not include a confirmed remediation (patch/version) or exploitation detail...
CVE-2023-48912
Dreamer CMS v4.1.3 was discovered to contain a Cross-Site Request Forgery CSRF via the component /admin/archives/edit...
Dreamer CMS Cross-Site Request Forgery Vulnerability
Dreamer CMS is a Dreamer Content Management System by Junnan Wang, an individual developer in China. A cross-site request forgery vulnerability exists in Dreamer CMS version v4.1.3, which stems from a cross-site request forgery CSRF vulnerability contained in the component /admin/archives/edit...
Alumne LMS Cross-Site Scripting Vulnerability
Alumne LMS is an e-learning platform from Alumne LMS, Inc. A cross-site scripting vulnerability exists in Alumne LMS version 4.0.0.1.08, which stems from a lack of proper cleanup in the localidad field on the /users/editmy page, and can be exploited by an attacker to inject a custom JavaScript lo...
League Table < 1.14 - Tables Cloning/Update/Deletion via CSRF
Description The plugin is vulnerable to Cross-Site Request Forgery due to missing or incorrect nonce validation in the view/tables.php file. This makes it possible for unauthenticated attackers to clone, edit, update, and delete tables via a forged request granted they can trick a site...
Astra Bulk Edit < 1.2.8 - Missing Authorization
Description The Astra Bulk Edit plugin for WordPress is vulnerable to unauthorized missing authorization due to a missing capability check on the savepostbulkedit function in versions up to, and including, 1.2.7. This makes it possible for attackers with contributor-level access or higher to bulk...
PT-2023-30657
Name of the Vulnerable Software and Affected Versions pyLoad version 0.5.0 Description The issue allows an authenticated user to upload files to arbitrary locations on the server, potentially leading to command execution by abusing scripts. When creating a new package, a subdirectory is created...
GHSA-V32M-PF9Q-P3XG Liferay Portal XSS with `p_l_back_url_title` on edit content page
Reflected cross-site scripting XSS vulnerability on a content page’s edit page in Liferay Portal 7.4.3.94 through 7.4.3.95 allows remote attackers to inject arbitrary web script or HTML via the plbackurltitle parameter...
PT-2023-32557 · Unknown · Getsimple Cms
Name of the Vulnerable Software and Affected Versions: GetSimpleCMS versions 3.3.16 through 3.4.0a Description: A critical issue affects the processing of the file /admin/theme-edit.php, leading to code injection. The attack can be initiated remotely. Recommendations: For versions 3.3.16 through...
The vulnerability of the interfaces_gif_edit.php and interfaces_gre_edit.php components of the software network interface card based on the FreeBSD Netgate pfSense operating system allows a hacker to execute arbitrary commands.
The vulnerability of the interfacesgifedit.php and interfacesgreedit.php components of the software network interface layer based on the FreeBSD Netgate pfSense operating system exists due to the failure to implement measures to neutralize special elements. Exploiting this vulnerability allows a...
CVE-2023-47528
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Sajjad Hossain Sagor WP Edit Username plugin = 1.0.5 versions...
CVE-2023-47528
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Sajjad Hossain Sagor WP Edit Username plugin = 1.0.5 versions...
CVE-2023-46580
Cross-Site Scripting XSS vulnerability in Inventory Management V1.0 allows attackers to execute arbitrary code via the pname parameter of the editProduct.php component...
CVE-2023-47528 WordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Sajjad Hossain Sagor WP Edit Username plugin = 1.0.5 versions...
CVE-2023-47528
CVE-2023-47528 concerns the WP Edit Username WordPress plugin (
CVE-2023-47528 WordPress WP Edit Username Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Sajjad Hossain Sagor WP Edit Username plugin = 1.0.5 versions...