CVE-2024-32080

CVE-2024-32080 is a Stored XSS in the WordPress plugin Search Keyword Redirect (Nick Pelton). The issue is described as Improper Neutralization of Input During Web Page Generation in the plugin, affecting versions from n/a through 1.0. No exploit details or patches are provided in the connected d...

CVE-2024-32080 WordPress Search Keyword Redirect plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Nick Pelton Search Keyword Redirect allows Stored XSS.This issue affects Search Keyword Redirect: from n/a through 1.0...

WordPress Search Keyword Redirect plugin <= 1.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by Sharanabasappa Patchstack Alliance in WordPress Plugin Search Keyword Redirect versions = 1.0...

WordPress Search Keyword Redirect Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Search Keyword Redirect Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-32080 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 9a5522e4a000 Credits Sharanabasappa Required privilege...

CVE-2024-22719

SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client...

WordPress Plugin Search Keyword Redirect 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blog sites on PHP and MySQL servers. WordPress Plugin Search Keyword Redirect A cross-si...

Form Tools SQL注入漏洞

Form Tools is an open source codebase for Form Tools scripts, modules, themes and APIs. A SQL injection vulnerability exists in Form Tools version 3.1.1, which originates from allowing an attacker to run arbitrary SQL commands via keyword while searching for clients...

CVE-2024-22719

CVE-2024-22719 describes an SQL injection in Form Tools 3.1.1 triggered by the keyword parameter during client search, enabling arbitrary SQL execution. Affected: Form Tools 3.1.1; root cause: unsanitized input in search; impact: high confidentiality/ integrity, CVSS v3.1 base = 8.1. Remediation:...

PT-2024-24385 · Unknown · Search Keyword Redirect

Name of the Vulnerable Software and Affected Versions: Search Keyword Redirect versions n/a through 1.0 Description: The issue is related to improper neutralization of input during web page generation, also known as Cross-site Scripting. This allows for Stored XSS attacks. Recommendations: For...

CVE-2024-22719

SQL Injection vulnerability in Form Tools 3.1.1 allows attackers to run arbitrary SQL commands via the 'keyword' when searching for a client...

PT-2024-19538 · Unknown · Form Tools

Name of the Vulnerable Software and Affected Versions: Form Tools version 3.1.1 Description: The issue allows attackers to run arbitrary SQL commands via the keyword when searching for a client. This can be exploited by manipulating the search functionality. Recommendations: For Form Tools versio...

PT-2024-25893 · Wangshen · Wangshen Secgate 3600

Name of the Vulnerable Software and Affected Versions: Wangshen SecGate 3600 up to 20240408 Description: A critical issue affects an unknown part of the file "/?g=net pro keyword import save". The manipulation of the reqfile argument leads to unrestricted upload. It is possible to initiate the...

CVE-2024-28092

UBEE DDW365 XCNDDW365 8.14.3105 software on hardware 3.13.1 allows a remote attacker within Wi-Fi proximity to conduct stored XSS attacks via RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, or RgParentalBasic.asp. The affected fields are SMTP Server Name, SMTP Username, Host Name, Ti...

CVE-2024-2351

A vulnerability classified as critical was found in CodeAstro Ecommerce Site 1.0. Affected by this vulnerability is an unknown functionality of the file action.php of the component Search. The manipulation of the argument catid/brandid/keyword leads to sql injection. The attack can be launched...

Ecommerce-Website SQL Injection Vulnerability

Ecommerce-Website is a complete e-commerce website with an administration panel built using PHP and MySql. A SQL injection vulnerability exists in Ecommerce-Website version 1.0, which stems from the parameter catid/brandid/keyword in the file action.php that can lead to SQL injection...

PT-2024-18086 · Unknown · Registry-Support

Name of the Vulnerable Software and Affected Versions: registry-support versions prior to v0.0.0-20240206 Description: A flaw was found in the decompression function of registry-support. This issue can be triggered if an unauthenticated remote attacker tricks a user into parsing a devfile which...

GHSA-9XFW-JJQ2-7V8H 1Panel set-cookie is missing the Secure keyword

Summary The https cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text when accessing http accidentally. https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/Set-Cookiesecure PoC Directly configure https for the panel, and the...

1Panel set-cookie is missing the Secure keyword

Summary The https cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text when accessing http accidentally. https://developer.mozilla.org/zh-CN/docs/Web/HTTP/Headers/Set-Cookiesecure PoC Directly configure https for the panel, and the...

Code injection

1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6...

CVE-2024-24768 1Panel set-cookie is missing the Secure keyword

1Panel is an open source Linux server operation and maintenance management panel. The HTTPS cookie that comes with the panel does not have the Secure keyword, which may cause the cookie to be sent in plain text if accessed using HTTP. This issue has been patched in version 1.9.6...