CVE-2024-33424

A cross-site scripting XSS vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Downloads parameter under the Language section...

CVE-2024-33424: Improper Neutralization of Input During Web Page Generation

A cross-site scripting XSS vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Downloads parameter under the Language section...

PT-2024-25246 · Cmsimple · Cmsimple

Name of the Vulnerable Software and Affected Versions: CMSimple version 5.15 Description: A Cross-Site Scripting XSS issue in the Settings menu of CMSimple allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section...

CVE-2024-33423

Cross-Site Scripting XSS vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section...

PT-2024-25247 · Cmsimple · Cmsimple

Name of the Vulnerable Software and Affected Versions: CMSimple version 5.15 Description: A cross-site scripting XSS vulnerability in the Settings menu allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Downloads parameter under the Language section...

CVE-2024-33423

Cross-Site Scripting XSS vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section...

PT-2024-20254 · WordPress · Float Menu

Name of the Vulnerable Software and Affected Versions: The Float menu WordPress plugin versions prior to 6.0.1 Description: The issue is related to the lack of a CSRF check in the bulk actions of the plugin, which could allow attackers to make logged-in admins delete arbitrary menus via a CSRF...

CVE-2024-33424

A cross-site scripting XSS vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Downloads parameter under the Language section...

CVE-2024-33423

The content management system CMSimple v5.15 is vulnerable to a Cross-Site Scripting (XSS) flaw (CWE-80) within its Settings menu . The root cause is the improper filtering of user input in the Logout parameter located under the Language section . Attackers can inject a crafted payload to execute...

CVE-2024-33423: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

Cross-Site Scripting XSS vulnerability in the Settings menu of CMSimple v5.15 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Logout parameter under the Language section...

WordPress Different Menu in Different Pages plugin <= 2.3.2 - Missing Authorization to Menu Duplication vulnerability

Missing Authorization to Menu Duplication vulnerability discovered by Lucio Sá in WordPress Plugin Different Menu in Different Pages versions = 2.3.2...

WordPress Different Menu in Different Pages Plugin <= 2.3.2 is vulnerable to Broken Access Control

Software Different Menu in Different Pages Type Plugin Vulnerable versions = 2.3.2 Fixed in 2.4.0 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-3206 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 11c1b4257a5d Credits Lucio Sá...

WordPress Login Logout Register Menu plugin <= 2.0 - Cross Site Scripting (XSS) vulnerability

Cross Site Scripting XSS vulnerability discovered by NGÔ THIÊN AN Patchstack Alliance in WordPress Plugin Login Logout Register Menu versions = 2.0...

Different Menu in Different Pages – Control Menu Visibility (All in One) <= 2.3.2 - Missing Authorization to Menu Duplication

Description The Different Menu in Different Pages – Control Menu Visibility All in One plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the ajax function in all versions up to, and including, 2.3.2. This makes it possible for authenticated attackers,...

CVE-2024-31747: Undefined Security Weakness

An issue in Yealink VP59 Microsoft Teams Phone firmware 91.15.0.118 fixed in 122.15.0.142 allows a physically proximate attacker to disable the phone lock via the Walkie Talkie menu option...

YeaLink VP59 安全漏洞

YeaLink VP59 is a flagship smart video phone from China-based YeaLink. A security vulnerability exists in the Yealink VP59 version 91.15.0.118, which stems from a vulnerability that allows a physically proximate attacker to disable phone lock via the Walkie Talkie menu option...

Fedora 40 : thunderbird (2024-d8a0e599e2)

The remote Fedora 40 host has a package installed that is affected by a vulnerability as referenced in the FEDORA-2024-d8a0e599e2 advisory. Update to 115.8.1 https://www.mozilla.org/en-US/security/advisories/mfsa2024-11/ read that if you have mails with encrypted email subjects...

WordPress ElementsKit Pro plugin <= 3.6.0 - Authenticated (Contributor+) Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets vulnerability

Authenticated Contributor+ Local File Inclusion via Price Menu, Hotspot, and Advanced Toggle Widgets vulnerability discovered by Webbernaut in WordPress Plugin ElementsKit Pro versions = 3.6.0...

WordPress Menu Plugin — Superfly Responsive Menu <= 5.0.25 - Authenticated (Subscriber+) Stored Cross-Site Scripting

Description The WordPress Menu Plugin — Superfly Responsive Menu plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.0.25 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with...

CMSimple Cross-Site Scripting Vulnerability (CNVD-2026-02658)

CMSimple is a free content management system. CMSimple suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data in the Edit parameter of the Settings menu, for which no detailed vulnerability details are available at this...