1222 matches found
Product Labels For Woocommerce < 1.5.4 - Authenticated (Shop manager+) Stored Cross-Site Scripting
Description The Product Labels For Woocommerce Sale Badges plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘'badgeLabel' parameter in all versions up to, and including, 1.5.3 due to insufficient input sanitization and output escaping. This makes it possible for...
python-django: Potential regular expression denial of service vulnerability in EmailValidator/URLValidator
A regular expression denial of service vulnerability has been found in Django. Email and URL validators are vulnerable to this flaw when processing a very large number of domain name labels of emails and URLs...
Improper Input Validation
libidn2.so is vulnerable to Improper Input Validation. The vulnerability is due to improper roundtrip checks while converting A-labels to U-labels. This makes it possible for an attacker to impersonate arbitrary domains...
CVE-2023-7068
CVE-2023-7068 affects the WordPress plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels up to version 4.3.0. Root cause: missing capability check on the print_packinglist action, enabling authenticated users with subscriber-level access and above to export orders co...
WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin <= 4.3.0 is vulnerable to Broken Access Control
Software WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Type Plugin Vulnerable versions = 4.3.0 Fixed in 4.3.1 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-7068 Patch priority Low CVSS severity Low 4.3 Developer Claim...
WordPress Plugin WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...
When anonymously accessed, the "Related Labels" section show labels that are tagged on pages in non-anonymous spaces.
h3. Issue Summary When anonymously accessed, the "Related Labels" section shows labels that are tagged on pages in non-anonymous spaces. This is reproducible on the Data Center: yes Pre-condition: 1. Page accessible anonymously has been labelled - e.g. label1 and label2. 2. Page that is not...
GitLab 12.9 < 13.8.7 / 13.9.0 < 13.9.5 / 13.10 < 13.10.1 (CVE-2021-22199)
The version of GitLab installed on the remote host is affected by a vulnerability, as follows: - An issue has been discovered in GitLab affecting all versions starting with 12.9. GitLab was vulnerable to a stored XSS if scoped labels were used. CVE-2021-22199 Note that Nessus has not tested for...
WordPress WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Plugin <= 4.2.1 is vulnerable to Privilege Escalation
Software WooCommerce PDF Invoices, Packing Slips, Delivery Notes and Shipping Labels Type Plugin Vulnerable versions = 4.2.1 Fixed in 4.3.0 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-51546 Patch priority Medium CVSS severity Medium...
Cross Site Scripting (XSS)
com.jfinal:jfinal is vulnerable to Cross-site Scripting XSS. Lack of proper validation for user input within the library's label management feature, exposes a Cross-Site Scripting XSS vulnerability which allows an authenticated attacker to inject malicious scripts into labels, which are then...
CVE-2023-48841
Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language Labels Export action...
CVE-2023-48841
Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language Labels Export action...
CVE-2023-48841
Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language Labels Export action...
CVE-2023-48835
Car Rental Script v3.0 is vulnerable to CSV Injection via a Language Labels Export action...
CVE-2023-48835
Car Rental Script v3.0 is vulnerable to CSV Injection via a Language Labels Export action...
Input validation
Appointment Scheduler 3.0 is vulnerable to CSV Injection via a Language Labels Export action...
Input validation
Car Rental Script v3.0 is vulnerable to CSV Injection via a Language Labels Export action...
Appointment Scheduler Security Vulnerability
PHPJabbers Appointment Scheduler is a Php-based appointment scheduler plugin for planning time and booking meeting schedules from PHPJabbers Serbia. A security vulnerability exists in Appointment Scheduler version 3.0, which stems from a CSV injection vulnerability in the Language Labels Export...
PT-2023-30978 · Unknown · Car Rental Script
Name of the Vulnerable Software and Affected Versions: Car Rental Script version 3.0 Description: The issue concerns a CSV Injection vulnerability. It can be exploited via the Language Labels Export action. Recommendations: For Car Rental Script version 3.0, consider disabling the Export action i...
CVE-2023-48841
CVE-2023-48841 affects PHPJabbers Appointment Scheduler 3.0. The vulnerability is a CSV injection in the Language > Labels > Export action, caused by insufficient input validation on the Unique ID field used to construct the CSV file. Impact is described as high (C/H/I/H/A/H) per CVSS data,...