119 matches found
Improper Authentication
GitLab is vulnerable to Missing Sanitization. This vulnerability exits due to the lack of validation of request URLs, allowing an attacker to include sensitive values from logged exception messages within invalid URLs, which are then logged...
CVE-2020-36731
The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction function...
PT-2023-11873
Name of the Vulnerable Software and Affected Versions Flexible Checkout Fields for WooCommerce plugin for WordPress versions up to and including 2.3.1 Description The issue is caused by missing authorization checks on the updateSettingsAction function, which is called via an admin init hook, and...
Cross-Site Scripting (XSS)
thorsten/phpmyfaq is vulnerable to Cross-Site Scripting XSS. The vulnerability exists in instances.php due to missing sanitization to escape newly added values which allows an attacker to inject and execute JavaScript...
CVE-2022-2799
The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...
Cross-site Scripting (XSS)
x-data-spreadsheet is vulnerable to cross-site scripting. The vulnerability exists due to the missing sanitization of values inserted into the cells, allowing an attacker to inject and execute malicious javascript...
x-data-spreadsheet through 1.1.9 vulnerable to Cross-site Scripting
All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting XSS due to missing sanitization of values inserted into the cells...
Cross site scripting
All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting XSS due to missing sanitization of values inserted into the cells...
CVE-2022-25646 Cross-site Scripting (XSS)
All versions of package x-data-spreadsheet are vulnerable to Cross-site Scripting XSS due to missing sanitization of values inserted into the cells...
morgan-json vulnerable to Arbitrary Code Execution
All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor...
Font-Converter Vulnerable to Arbitrary Command Injection
Overview font-converter is a FontForge wrapper that allows conversion between different font formats TTF, WOFF, OTF All versions of this package are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function. PoC js va...
CVE-2022-21165
All versions of package font-converter are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into the childprocess.exec function...
Design/Logic Flaw
All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor...
CVE-2022-25921 Arbitrary Code Execution
All versions of package morgan-json are vulnerable to Arbitrary Code Execution due to missing sanitization of input passed to the Function constructor...
CVE-2022-21165
The CVE-2022-21165 entry concerns the font-converter package (FontForge wrapper) where all versions are vulnerable to Arbitrary Command Injection due to missing sanitization of input that potentially flows into child_process.exec(). The core issue is input sanitization failure, enabling injection...
Remote Code Execution
react-editable-json-tree is vulnerable to remote code execution.The vulnerability exists in onSubmitValueParser prop which calls parse function in src/utils/parse.js because of missing sanitization of the parse parameters which allows a remote attacker to inject and execute malicious code into th...
mc-kill-port vulnerable to Arbitrary Command Execution via kill function
All versions of package mc-kill-port are vulnerable to Arbitrary Command Execution via the kill function, due to missing sanitization of the port argument...
GHSA-2CG4-7Q4X-7RR2 mc-kill-port vulnerable to Arbitrary Command Execution via kill function
All versions of package mc-kill-port are vulnerable to Arbitrary Command Execution via the kill function, due to missing sanitization of the port argument...