31 matches found
CVE-2026-58409: Unrestricted Upload of File with Dangerous Type
ChurchCRM is an open-source church management system. Prior to version 7.4.0, an authenticated administrator can achieve Remote Code Execution RCE on the server by installing a malicious plugin ZIP archive containing a PHP webshell. The application explicitly includes 'php' in its ALLOWEDEXTENSIO...
CVE-2025-9886: Cross-Site Request Forgery (CSRF)
The Trinity Audio – Text to Speech AI audio player to convert content into audio plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.20.2. This is due to missing or incorrect nonce validation in the '/admin/inc/post-management.php' file. This...
PT-2024-17567
Name of the Vulnerable Software and Affected Versions Admin Dashboard version 1.0 Description A problem has been found in the code of the file /vendor management.php. The manipulation of the username argument leads to cross site scripting. The attack can be initiated remotely. The exploit has bee...
CVE-2022-1658: Improper Access Control
Vulnerable versions of the Jupiter Theme = 6.10.1 allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abbremoveplugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, an...
PT-2022-14029
Name of the Vulnerable Software and Affected Versions Jupiter Theme versions = 6.10.1 Description The issue allows arbitrary plugin deletion by any authenticated user, including those with the subscriber role, via the abb remove plugin AJAX action. This action is registered in the...
PT-2022-17254
Name of the Vulnerable Software and Affected Versions DCN Firewall DCME-520 Description The issue is related to an arbitrary file download vulnerability. This vulnerability can be exploited via the path parameter in the file /audit/log/log management.php. Recommendations For DCN Firewall DCME-520...
NeDi Consulting NeDi Cross-Site Scripting Vulnerability (CNVD-2020-44576)
NeDi Consulting NeDi is a suite of open source software that supports the discovery and mapping of network devices from the Swiss company NeDi Consulting. A cross-site scripting vulnerability exists in NeDi Consulting NeDi version 1.9C. The vulnerability can be exploited to execute arbitrary...
CVE-2020-15029
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php sn parameter...
CVE-2020-15031
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php chg parameter...
Cross site scripting
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php chg parameter...
Cross site scripting
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php sn parameter...
CVE-2020-15029
CVE-2020-15029 affects NeDi 1.9C, vulnerable to cross-site scripting (XSS) via the Assets-Management.php sn parameter. The issue is a client-side script injection risk in the web UI that could allow arbitrary JavaScript execution in authenticated or guest contexts depending on access, as describe...
CVE-2020-15031
CVE-2020-15031 concerns NeDi 1.9C, where a cross-site scripting (XSS) vulnerability exists in the Assets-Management.php chg parameter, allowing an attacker to execute arbitrary JavaScript code. The vulnerability is documented across multiple sources (NVD entry and Red Hat advisory), specifying th...
PT-2020-14130
Name of the Vulnerable Software and Affected Versions NeDi version 1.9C Description The issue allows an attacker to execute arbitrary JavaScript code via the "Assets-Management.php" sn parameter, enabling a cross-site scripting XSS attack. Recommendations For NeDi version 1.9C, as a temporary...
CVE-2020-15031: Improper Neutralization of Input During Web Page Generation
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php chg parameter...
CVE-2020-15029: Improper Neutralization of Input During Web Page Generation
NeDi 1.9C is vulnerable to cross-site scripting XSS attack. The application allows an attacker to execute arbitrary JavaScript code via the Assets-Management.php sn parameter...
PT-2020-14132
Name of the Vulnerable Software and Affected Versions NeDi version 1.9C Description The issue allows an attacker to execute arbitrary JavaScript code via the "Assets-Management.php" chg parameter, enabling a cross-site scripting XSS attack. Recommendations For NeDi version 1.9C, as a temporary...
PT-2020-13753
Name of the Vulnerable Software and Affected Versions Kordil EDMS versions through 2.2.60rc3 Description The issue allows stored XSS in several PHP files, including users edit.php, users management edit.php, and user management.php. Recommendations For versions through 2.2.60rc3, consider disabli...
