Cross Site Scripting

typo3/cms is vulnerable to Cross Site Scripting. The vulnerability is caused due to a missing sanitization while rendering web page on the browser. This can lead to an authorized editors insert javascript commands by using the url scheme javascript:...

CVE-2024-3972: Cross-Site Request Forgery (CSRF)

The Similarity WordPress plugin through 3.0 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

PT-2024-26752 · WordPress · The Ungallery

Name of the Vulnerable Software and Affected Versions: The UnGallery WordPress plugin versions 2.2.4 and earlier Description: The issue concerns a lack of CSRF check in some areas and missing sanitization as well as escaping. This could allow attackers to make logged-in admins add Stored XSS...

CVE-2024-3058: Cross-Site Request Forgery (CSRF)

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-28662

A Cross Site Scripting vulnerability exists in Piwigo before 14.3.0 script because of missing sanitization in createtag in admin/include/functions.php...

SQL Injection

shopware/core and shopware/platform are vulnerable to SQL Injection. The vulnerability is caused due to a missing sanitization in the name field of the aggregations object while performing a search operation in Shopware application API. An attacker can exploit this using time-based SQL queries...

CSV Injection

Active Admin is vulnerable to CSV Injection. This vulnerability is due to missing sanitization while exporting a CSV file. An attacker can inject malicious data to a CSV file such as =, +, -', @, \t, \r which results in arbitrary macro execution if the csv file is opened in software such as excel...

CVE-2023-2123: Undefined Security Weakness

The WP Inventory Manager WordPress plugin before 2.1.0.13 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

Improper Authorization

gitLab is vulnerable to Missing Sanitization. This vulnerability exits due to the lack of validation of request URLs, allowing an attacker to include sensitive values from logged exception messages within invalid URLs, which are then logged...

Improper Authentication

GitLab is vulnerable to Missing Sanitization. This vulnerability exits due to the lack of validation of request URLs, allowing an attacker to include sensitive values from logged exception messages within invalid URLs, which are then logged...

CVE-2020-36731

The Flexible Checkout Fields for WooCommerce plugin for WordPress is vulnerable to Unauthenticated Arbitrary Plugin Settings update, in addition to Stored Cross-Site Scripting in versions up to, and including, 2.3.1. This is due to missing authorization checks on the updateSettingsAction function...

PT-2023-11873

Name of the Vulnerable Software and Affected Versions Flexible Checkout Fields for WooCommerce plugin for WordPress versions up to and including 2.3.1 Description The issue is caused by missing authorization checks on the updateSettingsAction function, which is called via an admin init hook, and...

CVE-2023-0420: Undefined Security Weakness

The Custom Post Type and Taxonomy GUI Manager WordPress plugin through 1.1 does not have CSRF, and is lacking sanitising as well as escaping in some parameters, allowing attackers to make a logged in admin put Stored Cross-Site Scripting payloads via CSRF...

PT-2023-16387

Name of the Vulnerable Software and Affected Versions WP Image Carousel WordPress plugin versions 1.0.2 and earlier Description The issue allows users with a role as low as contributor to perform Cross-Site Scripting attacks due to the plugin not sanitising and escaping some parameters...

Cross-Site Scripting (XSS)

thorsten/phpmyfaq is vulnerable to Cross-Site Scripting XSS. The vulnerability exists in instances.php due to missing sanitization to escape newly added values which allows an attacker to inject and execute JavaScript...

PT-2023-14688

Name of the Vulnerable Software and Affected Versions FL3R FeelBox WordPress plugin versions 8.1 and earlier Description The issue concerns a lack of CSRF check when updating settings, as well as missing sanitization and escaping. This could allow attackers to make logged-in admins add Stored XSS...

CVE-2022-4267: Undefined Security Weakness

The Bulk Delete Users by Email WordPress plugin through 1.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting...

CVE-2022-4005: Undefined Security Weakness

The Donation Button WordPress plugin through 4.0.0 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks...

CVE-2022-2799

The Affiliates Manager WordPress plugin before 2.9.14 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

Cross-site Scripting (XSS)

x-data-spreadsheet is vulnerable to cross-site scripting. The vulnerability exists due to the missing sanitization of values inserted into the cells, allowing an attacker to inject and execute malicious javascript...