16458 matches found
WordPress Admin Bar Editor Plugin <= 1.0.2.2 is vulnerable to Broken Access Control
Software Admin Bar Editor Type Plugin Vulnerable versions = 1.0.2.2 Fixed in 1.0.23 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-1716 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 919c0767c3fa Credits Lucio Sá Required privileg...
Foxit PDF Editor for Mac < 12.1.3 Multiple Vulnerabilities
According to its version, the Foxit PDF Editor for Mac application previously named Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 12.1.3. It is, therefore affected by multiple vulnerabilities: - Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution...
Foxit PDF Editor < 2024.2 Multiple Vulnerabilities
According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 2024.2. It is, therefore affected by multiple vulnerabilities: Note that Nessus has not tested for this issue but has instead relied only on the...
Foxit PDF Editor for Mac < 13.1 Multiple Vulnerabilities
According to its version, the Foxit PDF Editor for Mac application previously named Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 13.1. It is, therefore affected by multiple vulnerabilities: - Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution Vulnerability...
Foxit PDF Editor for Mac < 2024.2 Vulnerability
According to its version, the Foxit PDF Editor for Mac application previously named Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 2024.2. It is, therefore affected by vulnerability: Note that Nessus has not tested for this issue but has instead relied only on the...
Foxit PDF Editor for Mac < 11.1.7 Multiple Vulnerabilities
According to its version, the Foxit PDF Editor for Mac application previously named Foxit PhantomPDF for Mac installed on the remote macOS host is prior to 11.1.7. It is, therefore affected by multiple vulnerabilities: - Foxit PDF Reader Doc Object Use-After-Free Remote Code Execution...
Foxit PDF Editor < 12.1.5 Multiple Vulnerabilities
According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 12.1.5. It is, therefore affected by multiple vulnerabilities: - In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via...
Foxit PDF Editor < 13.1 Multiple Vulnerabilities
According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 13.1. It is, therefore affected by multiple vulnerabilities: - In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via JavaScrip...
Foxit PDF Editor < 11.2.9 Multiple Vulnerabilities
According to its version, the Foxit PDF Editor application previously named Foxit PhantomPDF installed on the remote Windows host is prior to 11.2.9. It is, therefore affected by multiple vulnerabilities: - In Foxit PDF Reader before 2024.1 and PDF Editor before 2024.1, code execution via...
WordPress Salon booking system plugin <= 9.6.5 - Editor+ Stored XSS via Email Settings vulnerability
Editor+ Stored XSS via Email Settings vulnerability discovered by Bob Matyas in WordPress Plugin Salon booking system versions = 9.6.5...
WordPress Salon booking system plugin <= 9.6.5 - Editor+ Stored XSS vulnerability
Editor+ Stored XSS vulnerability discovered by cyc707 in WordPress Plugin Salon booking system versions = 9.6.5...
CVE-2024-2439
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-2439 Salon booking system <= 9.6.5 - Editor+ Stored XSS
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-2439 Salon booking system <= 9.6.5 - Editor+ Stored XSS
The Salon booking system WordPress plugin through 9.6.5 does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2024-2603
CVE-2024-2603 affects the Salon booking system WordPress plugin (versions ≤ 9.6.5). The issue is due to incomplete sanitization/escaping of certain settings, enabling Stored XSS by high-privilege users (admin or editor, depending on configuration) even when unfiltered_html is disallowed (e.g., mu...
CVE-2024-2439
CVE-2024-2439 affects the Salon booking system WordPress plugin up to version 9.6.5. The vulnerability is a Stored XSS arising from insufficient sanitization/escaping of plugin settings, enabling high-privilege users (e.g., Editor) to inject script even if unfiltered_html is disabled (e.g., multi...
Popup4Phone <= 1.3.2 - Editor+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Go to "Popup4Phone Settings...
Popup4Phone <= 1.3.2 - Editor+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as Editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup 1. Go to "Popup4Phone Settings Form" ...
WP File Download Light <= 1.3.3 - Authenticated (Editor+) Stored Cross-Site Scripting
Description The WP File Download Light plugin for WordPress is vulnerable to Stored Cross-Site Scripting via settings in all versions up to, and including, 1.3.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with editor-level...