29 matches found
Server-Side Template Injection
nystudio107/craft-seomatic is vulnerable to server-side template injection. The vulnerability exists due to the lack of sanitization used for the url parameter in the safeCanonicalUrl function of Helper.php, allowing an attacker to inject and execute malicious code...
CVE-2022-27055
CVE-2022-27055 affects ecjia-daojia 1.38.1-20210202629. The issue is information leakage through content/apps/installer/classes/Helper.php: on installation, a new environment file is created that records database credentials (including the DB password). The vendor disputes that risk, noting the e...
CVE-2022-27055: Incorrect Authorization
ecjia-daojia 1.38.1-20210202629 is vulnerable to information leakage via content/apps/installer/classes/Helper.php. When the web program is installed, a new environment file is created, and the database information is recorded, including the database record password. NOTE: the vendor disputes thi...
PT-2022-18197 · Unknown · Ecjia-Daojia
Name of the Vulnerable Software and Affected Versions: ecjia-daojia version 1.38.1-20210202629 Description: The issue concerns information leakage via the content/apps/installer/classes/Helper.php file. When the web program is installed, a new environment file is created, recording database...
CVE-2022-0683
The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the settings parameter found in the /includes/Traits/Helper.php file which allows attackers to inject arbitrary web scripts onto a pages that executes...
PT-2022-13356
Name of the Vulnerable Software and Affected Versions Essential Addons for Elementor Lite versions up to and including 5.0.8 Description The issue arises from insufficient escaping and sanitization of the settings parameter in the /includes/Traits/Helper.php file, allowing attackers to inject...
CVE-2022-0683: Improper Neutralization of Input During Web Page Generation
The Essential Addons for Elementor Lite WordPress plugin is vulnerable to Cross-Site Scripting due to insufficient escaping and sanitization of the settings parameter found in the /includes/Traits/Helper.php file which allows attackers to inject arbitrary web scripts onto a pages that executes...
PT-2020-13030
Name of the Vulnerable Software and Affected Versions Open-AudIT version 3.3.1 Description An issue was discovered in Open-AudIT where shell metacharacter injection is possible via attributes to an "open-audit/configuration/" URI. An attacker can exploit this by adding an excluded IP address to t...
