Kirby 跨站脚本漏洞

Kirby is a file-based content management system CMS. Kirby suffers from a cross-site scripting vulnerability that allows a write-access editor to upload SVG files containing harmful content such as "script" tags...

CVE-2021-24134

Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user Editor+ to inject arbitrary JavaScript code or HTML in posts where the malicious fo...

GHSA-XP9C-82X8-7F67 Prototype Pollution in Node-Red

Impact Node-RED 1.2.7 and earlier contains a Prototype Pollution vulnerability in the admin API. A badly formed request can modify the prototype of the default JavaScript Object with the potential to affect the default behaviour of the Node-RED runtime. Patches The vulnerability is patched in the...

PT-2021-7971 · Node.Js · Node-Red

Name of the Vulnerable Software and Affected Versions: Node-RED versions 1.2.7 and earlier Description: The issue concerns a Prototype Pollution vulnerability in the admin API of Node-RED, a low-code programming tool for event-driven applications built using nodejs. A badly formed request can...

CVE-2020-26255

Kirby is a CMS. In Kirby CMS getkirby/cms before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of...

PT-2020-10361 · Tablepress · Tablepress

Name of the Vulnerable Software and Affected Versions: TablePress plugin version 1.9.2 Description: The issue allows tablepressdata CSV injection by Editor users. This could potentially lead to malicious actions when the CSV file is opened by an application. Note that the vendor disputes this...