Discourse 资源管理错误漏洞

Discourse is an open source community discussion platform. The platform includes features such as community, email and chat rooms. A resource management error vulnerability exists in Discourse, which stems from an unimposed size limit on client-side editable fields, and can be exploited by an...

CVE-2023-6781

The Orbit Fox by ThemeIsle plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's custom fields in all versions up to, and including, 2.10.26 due to insufficient input sanitization and output escaping on user supplied values. This makes it possible for authenticated...

CVE-2023-6446

The Calculated Fields Form plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 1.2.40 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

WordPress Plugin Calculated Fields Form Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-14957 · WordPress · Calculated Fields Form

Name of the Vulnerable Software and Affected Versions: Calculated Fields Form plugin for WordPress versions up to, and including, 1.2.40 Description: The issue is related to Stored Cross-Site Scripting via admin settings due to insufficient input sanitization and output escaping. This allows...

PT-2024-15132 · WordPress · Oxygen Builder

Name of the Vulnerable Software and Affected Versions: Oxygen Builder plugin for WordPress versions up to, and including, 4.8 Description: The issue is related to Stored Cross-Site Scripting via a custom field due to insufficient input sanitization and output escaping. This allows authenticated...

CVE-2023-6830

The Formidable Forms plugin for WordPress is vulnerable to HTML injection in versions up to, and including, 6.7. This vulnerability allows unauthenticated users to inject arbitrary HTML code into form fields. When the form data is viewed by an administrator in the Entries View Page, the injected...

CVE-2023-6830

CVE-2023-6830 affects the WordPress plugin Formidable Forms (

WordPress Advanced Custom Fields Plugin 3.1.1 < 6.0.3 Information Disclosure Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:advancedcustomfields:advancedcustomfields"; if description...

WordPress Advanced Custom Fields Pro Plugin < 6.1.6 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:advancedcustomfields:advancedcustomfieldspro"; if descriptio...

WordPress Advanced Custom Fields Plugin 5.8.10 < 5.12.6 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:advancedcustomfields:advancedcustomfields"; if description...

CVE-2022-40696

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in WP Engine Advanced Custom Fields ACF.This issue affects Advanced Custom Fields ACF: from 3.1.1 through 6.0.2...

CVE-2022-40696

CVE-2022-40696 affects WordPress plugin WP Engine Advanced Custom Fields (ACF): versions 3.1.1 through 6.0.2 are vulnerable to information disclosure. The underlying issue is described as a Custom Field Value Exposure via parsed shortcode from user input, leading to disclosure of sensitive data t...

PT-2024-11630 · Wp Engine · Wp Engine Advanced Custom Fields

Name of the Vulnerable Software and Affected Versions: WP Engine Advanced Custom Fields ACF versions 3.1.1 through 6.0.2 Description: The issue is related to the exposure of sensitive information to an unauthorized actor. This is a problem where sensitive data is made accessible to individuals wh...

WordPress Plugin Advanced Custom Fields Information Disclosure Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

Improper Input Validation

froxlor/froxlor is vulnerable to Improper Input Validation. The vulnerability is due to validation.js which does not effectively handle whitespace inputs in the form fields, which allowed users to escape the mandatory field checks...

Froxlor username/surname AND company field Bypass

Dear Sirs and Madams, I would like to report a business logic error vulnerability that I discovered during my recent penetration test on Froxlor. Specifically, I identified an issue where it was possible to submit the registration form with the essential fields, such as the username and password,...

CVE-2023-50256

Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements...

Design/Logic Flaw

Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements...

CVE-2023-50256 Froxlor username/surname AND company field Bypass

Froxlor is open source server administration software. Prior to version 2.1.2, it was possible to submit the registration form with the essential fields, such as the username and password, left intentionally blank. This inadvertent omission allowed for a bypass of the mandatory field requirements...