360 matches found
WordPress plugin Page Security & Membership 跨站脚本漏洞
WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Page Security & Membership plugin, which stems from the fact that the plugin does not...
Page Security & Membership <= 1.5.15 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in the "Force Public Pages" settings of the plugin...
WordPress Page Security & Membership plugin <= 1.5.15 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Ankur Bakre in WordPress Page Security & Membership plugin versions = 1.5.15. Solution Deactivate and delete. This plugin has been closed as of March 25, 2022 and is not available for download. This closure is temporary, pending a full...
Security Vulnerabilities fixed in Firefox ESR 91.6 — Mozilla
A Time-of-Check Time-of-Use bug existed in the Maintenance Updater Service that could be abused to grant Users write access to an arbitrary directory. This could have been used to escalate to SYSTEM access.This bug only affects Firefox on Windows. Other operating systems are unaffected. If a user...
The vulnerability of the Controller.class.php file on the high-performance PHP Workman server platform allows attackers to execute cross-site scripting attacks against Redis database management systems.
The vulnerability of the Controller.class.php file on the high-performance PHP Workman socket service platform is related to the lack of security measures for the web page structure. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...
CVE-2021-24425
The Floating Notification Bar, Sticky Menu on Scroll, and Sticky Header for Any Theme – myStickymenu WordPress plugin before 2.5.2 does not sanitise or escape its Bar Text settings, allowing hight privilege users to use malicious JavaScript in it, leading to a Stored Cross-Site Scripting issue,...
CVE-2021-22231
CVE-2021-22231 describes a denial-of-service impacting GitLab CE/EE pages for user profiles, starting with GitLab CE/EE 8.0. The issue allows an attacker to create a specially crafted username to block access to a user’s profile page. Multiple connected sources confirm the vulnerability exists in...
The vulnerability of the implementation of the automatic update server method for domain names in the Dynamic DNS system, in the embedded operating system OpenWrt, allows a perpetrator to compromise the confidentiality, integrity, and accessibility of the protected information.
The vulnerability of the implementation of the automatic update server method in Dynamic DNS systems for domain names in the OpenWrt embedded operating system is related to the lack of security measures for the web page structure. Exploiting this vulnerability allows a remote attacker to compromi...
GHSA-94WW-22RX-493X Cross-Site Scripting
Flower, before 0.9.2, has a XSS on tasks page because data is not properly escaped...
Alumni Management System 1.0 Cross Site Scripting
Exploit Title: Alumni Management System 1.0 - "Last Name field in Registration page" Stored XSS Exploit Author: Siva Rajendran Date: 2020-12-31 Vendor Homepage: https://www.sourcecodester.com/php/14524/alumni-management-system-using-phpmysql-source-code.html Software Link:...
The vulnerabilities of the formatting.php and SanitizeFileName.php components of the WordPress content management system allow attackers to compromise data integrity.
The vulnerability of the formatting.php and SanitizeFileName.php components of the WordPress content management system is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability could allow an attacker to compromise the integrity of data...
PYSEC-2020-154
In Wagtail before versions 2.7.4 and 2.9.3, when a form page type is made available to Wagtail editors through the wagtail.contrib.forms app, and the page template is built using Django's standard form rendering helpers such as form.asp, any HTML tags used within a form field's help text will be...
The vulnerability of the DAViCal calendar exchange server, related to deficiencies in the security measures used to protect web page structures, allows attackers to compromise data integrity.
The vulnerability of the DAViCal calendar exchange server is related to deficiencies in the security measures used to protect web page structures. Exploiting this vulnerability allows a malicious actor to influence data integrity through a specially crafted HTML page...
PT-2020-12094 · Chadha · Chadha Phpkb Standard Multi-Language
Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of URIs in admin/header.php, which allows for Reflected XSS attacks. This can be exploited in admin/manage-fields.php by adding a question mark ?...
PT-2020-12080 · Chadha · Chadha Phpkb Standard Multi-Language
Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of URIs in admin/header.php, which allows for Reflected XSS attacks. This can be exploited in admin/edit-user.php by adding a question mark ? followed...
PT-2020-12118 · Chadha · Chadha Phpkb Standard Multi-Language
Name of the Vulnerable Software and Affected Versions: Chadha PHPKB Standard Multi-Language version 9 Description: The issue concerns the handling of URIs in admin/header.php, which allows for Reflected XSS in admin/report-referrers.php. This can be achieved by adding a question mark ? followed b...
The vulnerability of the server management application for CentOS Web Panel lies in the lack of security measures for the web page structure, allowing attackers to elevate their privileges to the root level.
The vulnerability of the CentOS Web Panel administration application is related to the lack of security measures for the web page structure. Exploiting this vulnerability allows a malicious actor to elevate their privileges to root through the email address list page...
elearning-script 1.0 - Authentication Bypass
Exploit Title: elearning-script 1.0 - Authentication Bypass Author: riamloo Date: 2019-12-29 Vendor Homepage: https://github.com/amitkolloldey/elearning-script Software Link: https://github.com/amitkolloldey/elearning-script/archive/master.zip Version: 1 CVE: N/A Tested on: Win 10 Discription: E...
SQL Injection Vulnerability in OurPHP ou***_pa***.php Page
OurPHP is a web content management system developed using the PHP language. An SQL injection vulnerability exists in the OurPHP oupa.php page, which can be exploited by attackers to obtain sensitive information...
