4070 matches found
GHSA-XWG3-GJXH-C8PM Malicious Package in ngx-context-menu
Version 0.0.26 of ngx-context-menu contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment. It's also...
Malicious Package in ngx-context-menu
Version 0.0.26 of ngx-context-menu contained malicious code. The code when executed in the browser would enumerate password, cvc, cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment. It's also...
Malicious Package in mx-nested-menu
Version 0.1.30 of mx-nested-menu contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluat...
GHSA-48HW-37G6-3GW4 Malicious Package in mx-nested-menu
Version 0.1.30 of mx-nested-menu contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluat...
WP Floating Menu < 1.4.1 - Authenticated Reflected Cross-Site Scripting
The id GET parameter used by WP Floating menu does not correctly sanitise user input before reflecting the parameter back to the user, resulting in a reflected XSS vulnerability. Other sanitisation have been added to prevent other XSS issues as well as potential SQL injections...
WP Floating Menu < 1.4.1 - Authenticated Reflected Cross-Site Scripting
The id GET parameter used by WP Floating menu does not correctly sanitise user input before reflecting the parameter back to the user, resulting in a reflected XSS vulnerability. Other sanitisation have been added to prevent other XSS issues as well as potential SQL injections. PoC...
WordPress WP Floating Menu plugin <= 1.4.0 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability found by ZeroAptitude in WordPress WP Floating Menu plugin versions = 1.4.0. Solution Update the WordPress WP Floating Menu plugin to the latest available version at least 1.4.1...
WordPress Admin Menu plugin <= 1.1 - Authenticated Cross-Site Scripting (XSS) vulnerability
Authenticated Cross-Site Scripting XSS vulnerability found by zerodetail & ratherbland WordPress Admin Menu plugin versions = 1.1. Solution Plugin closed. Deactivate and delete...
WP Admin Menu Cross-Site Scripting Vulnerability
WordPress is a blogging platform developed using the PHP language, which supports the setting up of personal blog sites on servers with PHP and MySQL. It is widely used internationally and can be compatible with self-developed plug-ins. Powerful and widely used. Cross-site scripting vulnerability...
CVE-2020-24316
WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...
CVE-2020-24316
WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...
CVE-2020-24316
WP Plugin Rednumber Admin Menu v1.1 and lower does not sanitize the value of the "role" GET parameter before echoing it back out to the user. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...
CVE-2020-24316
CVE-2020-24316 affects the WordPress plugin Rednumber Admin Menu (versions 1.1 and lower). The vulnerability is a reflected XSS where the GET parameter role is echoed back without sanitization, enabling an attacker to craft a URL to execute client-side scripts. Exploitation is via a specially cra...
LimeSurvey 'Survey Menu' Stored Cross-Site Scripting Vulnerability
LimeSurvey formerly known as PHPSurveyor is a set of open source online questionnaire survey program from the LimeSurvey team, which supports survey program development, questionnaire distribution, and data collection. A stored cross-site scripting vulnerability exists in LimeSurvey 'Survey Menu'...
PT-2020-15681 · Rednumber · Wp Plugin Rednumber Admin Menu
Name of the Vulnerable Software and Affected Versions: WP Plugin Rednumber Admin Menu versions 1.1 and lower Description: The issue is related to a reflected XSS vulnerability. It occurs because the role GET parameter value is not sanitized before being echoed back to the user. This allows...
DBHcms Cross-Site Scripting Vulnerability (CNVD-2020-49087)
DBHcms is a small, free and open source content management system for personal and small business websites. A stored cross-site scripting vulnerability exists in DBHcms 1.2.0. The vulnerability stems from the failure of the htmlspecialchars function for the 'menudescription' variable in...
DBHcms Cross-Site Request Forgery Vulnerability (CNVD-2020-49090)
DBHcms is a small, free and open source content management system for personal and small business websites. DBHcms 1.2.0 suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to remove any menu via /index.php?dbhcmspid=-80&deletemenu=9...
CVE-2020-19882
DBHcms v1.2.0 has a stored xss vulnerability as there is no htmlspecialchars function for 'menudescription' variable in dbhcms\mod\mod.menus.edit.php line 83 and in dbhcms\mod\mod.menus.view.php line 111, A remote authenticated with admin user can exploit this vulnerability to hijack other users...