633 matches found
KONGA elevation of privilege vulnerability
KONGA is a full-featured open source, multi-user GUI from Dutch individual developer Panagis Tselentis. version 0.14.9 of KONGA contains an elevation of privilege vulnerability that could be exploited by attackers to gain full administrative access...
CVE-2021-25118
The Yoast SEO WordPress plugin from versions 16.7 until 17.2 discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities...
Design/Logic Flaw
The Yoast SEO WordPress plugin from versions 16.7 until 17.2 discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities or help during the exploitation of other identified vulnerabilities...
WordPress RSS feed with featured images | RSS Chimp plugin <= 1.2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress RSS feed with featured images | RSS Chimp plugin versions = 1.2.1. Solution Update the WordPress RSS feed with featured images | RSS Chimp plugin plugin to the latest available version at least 1.2.2...
WordPress "Really Simple Featured Video – Featured video support for Posts, Pages & WooCommerce Products" plugin <= 0.5.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress "Really Simple Featured Video – Featured video support for Posts, Pages & WooCommerce Products" plugin versions = 0.5.1. Solution Update the WordPress Really Simple Featured Video – Featured video...
WordPress RSS feed with featured images | RSS Chimp plugin <= 1.2.1 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress RSS feed with featured images | RSS Chimp plugin versions = 1.2.1. Solution Update the WordPress RSS feed with featured images | RSS Chimp plugin plugin to the latest available version at least 1.2.2...
WordPress Featured Images in RSS for Mailchimp & More plugin < 1.5.9 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Featured Images in RSS for Mailchimp & More plugin versions 1.5.9. Solution Update the WordPress Featured Images in RSS for Mailchimp & More plugin to the latest available version at least 1.5.9...
CVE-2021-24932
The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.3 does not sanitise and escape the postid parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24932
The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.3 does not sanitise and escape the postid parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue...
Cross site scripting
The Auto Featured Image Auto Post Thumbnail WordPress plugin before 3.9.3 does not sanitise and escape the postid parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue...
CVE-2021-24932
The CVE-2021-24932 entry concerns the WordPress plugin Auto Featured Image (Auto Post Thumbnail) prior to version 3.9.3. The vulnerability is a Reflected Cross-Site Scripting (XSS) flaw caused by insufficient sanitisation/escaping of the post_id parameter in an admin page output within a JS block...
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. Auto Featured Image Plugin is a WordPress open source application plugin. WordPress Auto Featured Image Plugin prio...
Auto Featured Image < 3.9.3 - Reflected Cross-Site Scripting
The plugin does not sanitise and escape the postid parameter before outputting back in an admin page within a JS block, leading to a Reflected Cross-Site Scripting issue. PoC https://example.com/wp-admin/upload.php?page=menu-media-aptid=alert/XSS/...
WordPress Auto Featured Image (Auto Post Thumbnail) plugin <= 3.9.2 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by JrXnm in WordPress Auto Featured Image Auto Post Thumbnail plugin versions = 3.9.2. Solution Update the WordPress Auto Featured Image Auto Post Thumbnail plugin to the latest available version at least 3.9.3...
Cross-Site Request Forgery (CSRF) in hdinnovations/unit3d-community-edition
Description Attacker is able to change a torrents featured state to if a logged in user visits attacker website. Proof of Concept 1. When you logged in open this POC.html in a browser. 2. You can check the torrents state changed to featured. history.pushState'', '', '/' document.forms0.submit;...
uListing < 2.0.6 - Authenticated IDOR
An Authenticated User IDOR vulnerability was discovered in the plugin. Important: userid and listingid values are dependent on each other, that is, if the author ID == 4, the data can only be modified for those ADs and pages that relate to this particular ID. You can find out the author of the...
Hisense A5 series cell phones have information leakage vulnerability
Hisense owns two listed companies in Shanghai, Shenzhen and Hong Kong, Hisense Video 600060 and Hisense Home Appliances 000921, and owns a number of brands such as Hisense, Toshiba, Gorenje, Kelon, Ronshen and ASKO. The information disclosure vulnerability exists in Hisense A5 series cell phones...
[SECURITY] Fedora 32 Update: lucene-8.4.1-9.fc32
Apache Lucene is a high-performance, full-featured text search engine library written entirely in Java. It is a technology suitable for nearly any application that requires full-text search, especially cross-platform...
Joomla! 1.7.0 - 3.9.15 SQLi Vulnerability
Joomla! is prone to an SQL injection SQLi vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:joomla:joomla";...