MAL-2022-3070 Malicious code in flat-surface-shader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b79619ad01b41b1f647e4d1d03d5d0de5fa184d9232c5628b2585cc8786bbaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in flat-surface-shader (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 2b79619ad01b41b1f647e4d1d03d5d0de5fa184d9232c5628b2585cc8786bbaf Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Automad cross-site scripting vulnerabilities

automad is a flat file content management system and template engine. automad version 1.10.9 and prior versions contain a cross-site scripting vulnerability that can be exploited by attackers to cause cross-site scripting attacks...

pariscenterflat.com Cross Site Scripting vulnerability OBB-2466539

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Flat Rate Shipping Plugin For WooCommerce plugin <= 4.0.2 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Flat Rate Shipping Plugin For WooCommerce plugin versions = 4.0.2. Solution Update the WordPress Flat Rate Shipping Plugin For WooCommerce plugin to the latest available version at least 4.0.3...

WordPress Flat Rate Shipping Plugin For WooCommerce plugin <= 4.0.2 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Flat Rate Shipping Plugin For WooCommerce plugin versions = 4.0.2. Solution Update the WordPress Flat Rate Shipping Plugin For WooCommerce plugin to the latest available version at least 4.0.3...

Statamic code injection vulnerability

Statamic is a powerful flat file Cms built on Laravel by Statamic, Inc. for storing all content, templates, assets, and settings in files instead of a database. Statamic suffers from a code injection vulnerability that arises from a network system or product not properly filtering specific elemen...

CVE-2021-39319: Improper Neutralization of Input During Web Page Generation

The duoFAQ - Responsive, Flat, Simple FAQ WordPess plugin is vulnerable to Reflected Cross-Site Scripting via the msg parameter found in the /duogeek/duogeek-panel.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.8...

WordPress Flat Preloader plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Flat Preloader Plugin in versions prior to 1.5.5 has a cross-site scripting vulnerability that stems from...

CVE-2021-24789

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24685

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload triggered either in the frontend or backend...

CVE-2021-24789

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24789 Flat Preloader < 1.5.5 - Admin+ Stored Cross-Site Scripting

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

CVE-2021-24789

The CVE refers to WordPress Flat Preloader plugin pre-1.5.5. Connected sources confirm a cross-site scripting (XSS) vulnerability where certain settings are not escaped when output in HTML attributes, enabling an attacker with admin-level access to trigger client-side JS even when unfiltered_html...

CVE-2021-24685

The CVE-2021-24685 affects the Flat Preloader WordPress plugin prior to version 1.5.4. Root cause: the plugin does not enforce nonce checks when saving settings and fails to sanitise/escape inputs, enabling a logged-in admin to modify settings that can trigger stored Cross-Site Scripting (XSS) pa...

CVE-2021-24685 Flat Preloader < 1.5.4 - CSRF to Stored Cross-Site Scripting

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload triggered either in the frontend or backend...

PT-2021-16283

Name of the Vulnerable Software and Affected Versions: Flat Preloader WordPress plugin versions prior to 1.5.5 Description: The issue allows high privilege users to perform Cross-Site Scripting attacks due to the plugin not escaping some of its settings when outputting them in attributes in the...

CVE-2021-24789: Improper Neutralization of Input During Web Page Generation

The Flat Preloader WordPress plugin before 1.5.5 does not escape some of its settings when outputting them in attribute in the frontend, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed...

PT-2021-16195 · WordPress · Flat Preloader

Name of the Vulnerable Software and Affected Versions: Flat Preloader WordPress plugin versions prior to 1.5.4 Description: The issue arises from the lack of nonce checks when saving settings and the failure to sanitise and escape them, which could allow attackers to make logged-in admins change...

CVE-2021-24685: Cross-Site Request Forgery (CSRF)

The Flat Preloader WordPress plugin before 1.5.4 does not enforce nonce checks when saving its settings, as well as does not sanitise and escape them, which could allow attackers to a make logged in admin change them with a Cross-Site Scripting payload triggered either in the frontend or backend...