Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization in the IsAuthorized function in ContentPermissionsQueryStringHandler.cs and MediaPermissionsQueryStringHandler.cs. A user with Editor permissions can retrieve or delete content and media of other users by passing...

WordPress plugin Google News Editors Picks Feed Generator 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

CVE-2024-10705

The Multiple Page Generator Plugin – MPG plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 4.0.5 via the 'mpgdownloadfilebylink' function. This makes it possible for authenticated attackers, with editor-level access and above, to make web...

CVE-2025-23039 Cross Site Scripting on URL decode Tooltip in Caido

Caido is a web security auditing toolkit. A Cross-Site Scripting XSS vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to...

CVE-2025-23039 Cross Site Scripting on URL decode Tooltip in Caido

Caido is a web security auditing toolkit. A Cross-Site Scripting XSS vulnerability was identified in Caido v0.45.0 due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This issue could allow an attacker to execute arbitrary scripts, potentially leading to...

PT-2025-4785 · Caido · Caido

Name of the Vulnerable Software and Affected Versions: Caido version 0.45.0 Description: A Cross-Site Scripting XSS issue was identified in Caido due to improper sanitization in the URL decoding tooltip of HTTP request and response editors. This could allow an attacker to execute arbitrary script...

CVE-2024-8857

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitise and escape some of its settings, which could allow high privilege users such as editors to perform Stored Cross-Site Scripting attacks...

CVE-2024-8855

The WordPress Auction Plugin WordPress plugin through 3.7 does not sanitize and escape a parameter before using it in a SQL statement, allowing editors and above to perform SQL injection attacks...

The vulnerability of PDF viewing and editing programs such as Acrobat Document Cloud, Adobe Reader Document Cloud, Adobe Reader, and Adobe Acrobat lies in their memory management after memory is freed. This allows attackers to execute arbitrary code.

The vulnerability of PDF viewing and editing programs like Acrobat Document Cloud, Adobe Reader Document Cloud, Adobe Reader, and Adobe Acrobat is related to the use of memory after it is freed. Exploiting this vulnerability can allow an attacker to execute arbitrary code using a specially create...

CVE-2024-7879

The CVE-2024-7879 entries concern the WP ULike WordPress plugin (versions before 4.7.5) where certain settings are not properly sanitised/escaped. The Red Hat, NVD, and CVE lists describe this as a stored XSS vector that could be triggered by high-privilege users (e.g., editors) even when unfilte...

PT-2024-39708 · WordPress · Category/Taxonomy Image

Name of the Vulnerable Software and Affected Versions: The Category and Taxonomy Image plugin for WordPress versions up to, and including, 1.0.0 Description: The issue is related to Stored Cross-Site Scripting via the category image parameter due to insufficient input sanitization and output...

UBUNTU-CVE-2022-4973

WordPress Core, in versions up to 6.0.2, is vulnerable to Authenticated Stored Cross-Site Scripting that can be exploited by users with access to the WordPress post and page editor, typically consisting of Authors, Contributors, and Editors making it possible to inject arbitrary web scripts into...

The vulnerability of Microsoft Office Visio packages and Microsoft 365 Apps for Enterprise allows a perpetrator to execute arbitrary code.

The vulnerability of Microsoft Office Visio package editors within Microsoft Office and Microsoft 365 Apps for Enterprise programs is related to the absence of warnings about dangerous actions. Exploiting this vulnerability could allow an attacker to execute arbitrary code...

The vulnerabilities of PDF viewing and editing programs like Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2020, and Adobe Acrobat Reader 2020, as well as Adobe Acrobat 2024, are related to data type mixing errors. These vulnerabilities allow attackers to execute arbitrary code.

The vulnerabilities of PDF viewing and editing programs such as Adobe Acrobat Document Cloud, Adobe Acrobat Reader Document Cloud, Adobe Acrobat 2020, and Adobe Acrobat Reader 2020 are related to data type mixing errors. Exploiting these vulnerabilities can allow attackers to execute arbitrary co...

MAL-2024-8915 Malicious code in bamoe-standalone-bpmn-and-dmn-editors-classic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3f4337208b3b0a1e286af8a7334f3d815345a95eb2dadeb5c4b58fdd4b43a8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in bamoe-standalone-bpmn-and-dmn-editors-classic (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware d3f4337208b3b0a1e286af8a7334f3d815345a95eb2dadeb5c4b58fdd4b43a8f Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Cross Site Scripting

typo3/cms is vulnerable to Cross Site Scripting. The vulnerability is caused due to a missing sanitization while rendering web page on the browser. This can lead to an authorized editors insert javascript commands by using the url scheme javascript:...

GHSA-GC5H-6JX9-Q2QH eZ Platform Admin UI vulnerable to DOM-based Cross-site Scripting in file upload widget

Impact The file upload widget is vulnerable to XSS payloads in filenames. Access permission to upload files is required. As such, in most cases only authenticated editors and administrators will have the required permission. It is not persistent, i.e. the payload is only executed during the uploa...

CVE-2024-39318

The CVE-2024-39318 entry maps to a concrete DOM-based XSS in the Ibexa Admin UI Bundle file-upload widget. The vulnerability stems from insufficient sanitization of filenames, allowing XSS payloads to be executed during upload when the attacker has upload-permission (typically authenticated edito...

Cross-Site Scripting (XSS)

typo3/cms is vulnerable to Cross-Site Scripting XSS.The vulnerability is caused due to improper encoding of editor input, allowing authenticated editors to inject arbitrary HTML...