401 matches found
CVE-2020-1756
In Moodle before 3.8.2, 3.7.5, 3.6.9 and 3.5.11, insufficient input escaping was applied to the PHP unit webrunner admin tool...
CVE-2020-1756
CVE-2020-1756 affects Moodle prior to 3.8.2, 3.7.5, 3.6.9 and 3.5.11, where insufficient input escaping was applied to the PHP unit webrunner admin tool. Root cause: inadequate escaping in the webrunner admin tool. Consequence per sources: potential impact on confidentiality, integrity, and avail...
WordPress plugin Contact Form DB 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2022-2460 WPDating < 7.4.0 - Multiple Unauthenticated SQLi
The WPDating WordPress plugin before 7.4.0 does not properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities exploitable by unauthenticated users...
WordPress plugin WPDating SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exist...
PT-2022-16747 · WordPress · Wpdating
Name of the Vulnerable Software and Affected Versions: WPDating WordPress plugin versions prior to 7.4.0 Description: The issue arises from the plugin's failure to properly escape user input before concatenating it to certain SQL queries, leading to multiple SQL injection vulnerabilities. These...
GHSA-C558-5GFM-P2R8 JSPUI spellcheck and autocomplete tools vulnerable to Cross Site Scripting
Impact The JSPUI spellcheck "Did you mean" HTML escapes the data-spell attribute in the link, but not the actual displayed text. Similarly, the JSPUI autocomplete HTML does not properly escape text passed to it. Both are vulnerable to XSS. This vulnerability only impacts the JSPUI. This...
Online Student Admission System 跨站脚本漏洞
Online Student Admission System is an online student admission system. It is used to computerize all pre- and post-admission activities of an institution. A cross-site scripting vulnerability exists in the Online Student Admission System, which stems from an unknown function in its student user...
PT-2022-7868 · Nodepdf · Nodepdf
Name of the Vulnerable Software and Affected Versions: nodepdf version 1.3.0 Description: The issue arises from the input passed to the Pdf function being shell escaped and then passed to child process.exec during PDF rendering. However, the shell escape fails to properly encode special character...
CVE-2022-2071
The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the filename parameter in the 'New Page' dialog on the Overview or Pages page. Details Cross-site scripting or XSS is a code vulnerability that occurs when an attacker “injects” a malicious script into an...
CVE-2022-2090
The Discount Rules for WooCommerce WordPress plugin before 2.4.2 does not escape a parameter before outputting it back in an attribute of the plugin's discount rule page, leading to Reflected Cross-Site Scripting...
VMware vRealize Log Insight 跨站脚本漏洞
VMware vRealize Log Insight is a centralized log management solution from VMware. The product supports features such as log organization and log analysis. A cross-site scripting vulnerability exists in VMware vRealize Log Insight versions prior to 8.8.2, which stems from improper input escaping i...
VMware vRealize Log Insight 跨站脚本漏洞
VMware vRealize Log Insight is a centralized log management solution from VMware. The product supports features such as log organization and log analysis. A cross-site scripting vulnerability exists in VMware vRealize Log Insight versions prior to 8.8.2, which stems from improper input escaping i...
CVE-2022-31108 Arbitrary `CSS` injection into the generated graph affecting the container HTML in mermaid.js
Mermaid is a JavaScript based diagramming and charting tool that uses Markdown-inspired text definitions and a renderer to create and modify complex diagrams. An attacker is able to inject arbitrary CSS into the generated graph allowing them to change the styling of elements outside of the...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS via the keywords parameter in the management toolbar search. An attacker can execute arbitrary web scripts or inject HTML by supplying crafted input. Details Cross-site scripting or XSS is a code vulnerability...
WordPress plugin WPQA 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. cross-site scripting vulnerability exists in versions of WordPress WPQAs plugin prior to 5.2, which...
GHSA-5PPX-RGW2-XG23 Improper Neutralization of Input During Web Page Generation in Jenkins
Jenkins 2.88 and earlier; 2.73.2 and earlier Autocompletion suggestions for text fields were not escaped, resulting in a persisted cross-site scripting vulnerability if the source for the suggestions allowed specifying text that includes HTML metacharacters like less-than and greater-than...
GHSA-JFF5-55XJ-4JCQ Improper Neutralization of Input During Web Page Generation in Jenkins
jenkins before versions 2.44, 2.32.2 is vulnerable to a persisted cross-site scripting in search suggestions due to improperly escaping users with less-than and greater-than characters in their names SECURITY-388...