CVE-2024-41693 Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Mashov - CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page Basic XSS...

CVE-2024-3986: Improper Neutralization of Input During Web Page Generation

The SportsPress WordPress plugin before 2.7.22 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-5809: Improper Neutralization of Input During Web Page Generation

The WP Ajax Contact Form WordPress plugin through 2.2.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against admin users...

Mikafon MA7 SQL注入漏洞

Mikafon MA7 is an application from Mikafon Inc. A SQL injection vulnerability exists in Mikafon MA7 versions v3.0 through v3.1, which stems from improper neutralization using a special element resulting in SQL injection...

The vulnerability in the GLPI system’s handling of requests and incidents, related to improper neutralization of special elements used in SQL commands, allows an attacker to carry out an attack based on time, using SQL injections in the REST API user_token.

The vulnerability of the GLPI system for handling requests and incidents is related to the improper neutralization of certain special elements. Exploiting this vulnerability allows a malicious actor to scan server ports or services, and to carry out attacks based on timing, using SQL injections i...

CVE-2024-6542

Improper neutralization of livestatus command delimiters in mknotifyd in Checkmk = 2.0.0p39, 2.1.0p47, 2.2.0p32 and 2.3.0p11 allows arbitrary livestatus command execution...

CVE-2024-37259

The WP Extended (The Ultimate WordPress Toolkit) plugin for WordPress is vulnerable to Stored Cross-Site Scripting (XSS) in versions up to and including 2.4.7 . The root cause is insufficient input sanitization and output escaping , which allows unauthenticated attackers to inject arbitrary web s...

PT-2024-27551

Name of the Vulnerable Software and Affected Versions Uncanny Toolkit Pro for LearnDash versions prior to 4.1.4.1 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS attacks...

PT-2024-27441

Name of the Vulnerable Software and Affected Versions Cards for Beaver Builder versions 1.1.4 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This is a type of security vulnerability that occurs...

PT-2024-27534

Name of the Vulnerable Software and Affected Versions WP Photo Album Plus versions through 8.8.00.002 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations For version...

PT-2024-27379

Name of the Vulnerable Software and Affected Versions Ali2Woo Lite versions 3.3.5 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Reflected XSS. Recommendations For Ali2Woo Lite...

PT-2024-27429

Name of the Vulnerable Software and Affected Versions Groundhogg versions 3.4.2.3 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows Reflected XSS, which can be exploited by attackers...

PT-2024-27405

Name of the Vulnerable Software and Affected Versions WPMU DEV Branda versions 3.4.17 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations For versio...

PT-2024-27300

Name of the Vulnerable Software and Affected Versions WP Post Author versions 3.6.7 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations For versions...

PT-2024-28221

Name of the Vulnerable Software and Affected Versions UiPress lite versions 3.4.06 and earlier Description The issue is related to an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows for SQL Injection attacks. Recommendations For...

PT-2024-27532

Name of the Vulnerable Software and Affected Versions Depicter Slider versions through 3.0.2 Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS. Recommendations For versions through...

PT-2024-27550

Name of the Vulnerable Software and Affected Versions Atarim versions 3.31 and earlier Description The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows for Stored XSS attacks. Recommendations For Atarim versions...

CVE-2024-37414: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in Depicter Slider and Popup by Averta Depicter Slider allows Stored XSS.This issue affects Depicter Slider: from n/a through 3.0.2...

CVE-2024-41709: Improper Neutralization of Input During Web Page Generation

Backdrop CMS before 1.27.3 and 1.28.x before 1.28.2 does not sufficiently sanitize field labels before they are displayed in certain places. This vulnerability is mitigated by the fact that an attacker must have a role with the "administer fields" permission...

CVE-2024-37263: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in ThemeLooks Enter Addons enteraddons allows Stored XSS.This issue affects Enter Addons: from n/a through 2.1.6...