11826 matches found
WordPress Custom WooCommerce Checkout Fields Editor Plugin <= 1.2.9 is vulnerable to Cross Site Scripting (XSS)
Software Custom WooCommerce Checkout Fields Editor Type Plugin Vulnerable versions = 1.2.9 Fixed in 1.3.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bb5649dadedf Credits Rafie...
WordPress Advanced Custom Fields options import/export Plugin <= 1.0.5 is vulnerable to Cross Site Scripting (XSS)
Software Advanced Custom Fields options import/export Type Plugin Vulnerable versions = 1.0.5 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4db49edd1f34 Credits Rafie...
WordPress GFireM Fields Plugin <= 1.1.6 is vulnerable to Cross Site Scripting (XSS)
Software GFireM Fields Type Plugin Vulnerable versions = 1.1.6 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 7b9137f7b7a5 Credits Rafie Muhammad Patchstack Required...
SUSE CVE-2023-29457
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts...
DEBIAN-CVE-2023-29457
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts...
UBUNTU-CVE-2023-29457
Reflected XSS attacks, occur when a malicious script is reflected off a web application to the victim's browser. The script can be activated through Action form fields, which can be sent as request to a website with a vulnerability that enables execution of malicious scripts...
CVE-2021-4423
The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the rsgdinsertupdate function. This makes it possible for unauthenticated attackers to update post fields via a forged...
CVE-2023-2869
The WP-Members Membership plugin for WordPress is vulnerable to unauthorized plugin settings update due to a missing capability check on the dofieldreorder function in versions up to, and including, 3.4.7.3. This makes it possible for authenticated attackers with subscriber-level access to reorde...
CVE-2021-4407
The Custom Banners plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.2 This is due to missing or incorrect nonce validation on the saveCustomFields function. This makes it possible for unauthenticated attackers to save custom fields via a forge...
CVE-2023-36375
Cross Site Scripting vulnerability in Hostel Management System v2.1 allows an attacker to execute arbitrary code via a crafted payload to the Guardian name, Guardian relation, complimentary address, city, permanent address, and city parameters in the Book Hostel & Room Details page...
CVE-2023-3561
A vulnerability, which was classified as problematic, was found in GZ Scripts PHP GZ Hotel Booking Script 1.8. This affects an unknown part of the file /load.php. The manipulation of the argument firstname/secondname/phone/address1/country leads to cross site scripting. It is possible to initiate...
The vulnerability of Zoom video conferencing software, related to the disclosure of information in erroneous data fields, allows a perpetrator to gain unauthorized access to protected information.
The vulnerability of Zoom video conferencing software is related to the exposure of information in the erroneous data area. Exploiting this vulnerability can allow a remote attacker to gain unauthorized access to protected information...
GZ Scripts Ticket Booking Script 跨站脚本漏洞
GZ Scripts Ticket Booking Script is a ticket booking system from GZ Scripts. A cross-site scripting vulnerability exists in GZ Scripts Ticket Booking Script version 1.8, which stems from cross-site scripting due to incorrect manipulation of the parameters firstname, secondname, phone, address1, a...
GZScripts PHP GZ Appointment Scheduling Script 跨站脚本漏洞
GZScripts is a script from GZScripts Inc. A cross-site scripting vulnerability exists in GZScripts PHP GZ Appointment Scheduling Script version 1.8, which stems from the parameter firstname/secondname/phone/address1/country in the file /load.php that causes cross-site scripting...
PT-2023-25231 · Unknown · Gz Scripts Php Gz Hotel Booking Script
Name of the Vulnerable Software and Affected Versions: GZ Scripts PHP GZ Hotel Booking Script version 1.8 Description: A problematic issue was found in the software, affecting an unknown part of the file /load.php. The manipulation of the arguments first name, second name, phone, address 1, or...
CVE-2023-37064
Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section...
CVE-2023-37064
Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section...
Design/Logic Flaw
Chamilo 1.11.x up to 1.11.20 allows users with admin privilege account to insert XSS in the extra fields management section...
PT-2023-25777 · Chamilo · Chamilo
Name of the Vulnerable Software and Affected Versions: Chamilo versions 1.11.x up to 1.11.20 Description: The issue allows users with admin privilege accounts to insert XSS in the extra fields management section. Recommendations: For Chamilo versions 1.11.x up to 1.11.20, consider restricting...