759 matches found
CVE-2024-1562
The WooCommerce Google Sheet Connector plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the executepostdata function in all versions up to, and including, 1.3.11. This makes it possible for unauthenticated attackers to update plugin...
VulnCheck KEV: CVE-2016-10108
Unauthenticated Remote Command injection as root occurs in the Western Digital MyCloud NAS 2.11.142 /web/googleanalytics.php URL via a modified arg parameter in the POST data...
Design/Logic Flaw
Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The config function in app/routes.py does not validate the user-controlled name variable on line 447 and configdata variable o...
CVE-2024-22204 Whoogle Search Limited File Write vulnerability
Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration options in Whoogle are enabled. The config function in app/routes.py does not validate the user-controlled name variable on line 447 and configdata variable o...
CVE-2023-5411
The Funnelforms Free plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the fnsfaf2savepost function in versions up to, and including, 3.4. This makes it possible for authenticated attackers, with subscriber-level permissions and above, to...
VulnCheck KEV: CVE-2022-0867
The Pricing Table WordPress plugin before 3.6.1 fails to properly sanitize and escape user supplied POST data before it is being interpolated in an SQL statement and then executed via an AJAX action available to unauthenticated users...
PT-2023-32349
Name of the Vulnerable Software and Affected Versions The News & Blog Designer Pack – WordPress Blog Plugin versions up to, and including, 3.4.1 Description The issue is related to Remote Code Execution via Local File Inclusion. This is due to the bdp get more post function utilizing an unsafe...
The vulnerability of the gwcfg_cgi_set_manage_post_data() function in the microprogramming-based industrial Wi-Fi routers developed by Yifan YF325 allows a hacker to influence the integrity, accessibility, and confidentiality of the protected information.
The vulnerability of the gwcfgcgisetmanagepostdata function in the microprogrammed industrial Wi-Fi routers from Yifan YF325 relates to the execution of operations outside the buffer in memory. Exploiting this vulnerability could allow an attacker to influence the integrity, availability, and...
Yifan YF325 缓冲区错误漏洞
Yifan YF325 is a wireless router from Yifan. The Yifan YF325 suffers from a buffer overflow vulnerability that stems from a boundary error in the gwcfgcgisetmanagepostdata function malloc function when handling untrusted input. An attacker can exploit this vulnerability to cause a buffer overflow...
Yifan YF325 Buffer Error Vulnerability
Yifan YF325 is a wireless router from Yifan. A buffer error vulnerability exists in Yifan YF325 v1.020221108, which stems from a buffer overflow vulnerability in the gwcfgcgisetmanagepostdata function...
CVE-2021-4416
The wp-mpdf plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.5.1. This is due to missing or incorrect nonce validation on the mpdfadminsavepost function. This makes it possible for unauthenticated attackers to save post data via a forged request...
CVE-2021-4415
The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...
Cross site request forgery (csrf)
The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...
CVE-2021-4415 Sunshine Photo Cart <= 2.8.28 - Cross-Site Request Forgery Bypass
The Sunshine Photo Cart plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.8.28 This is due to missing or incorrect nonce validation on the sunshineproductsquicksavepost function. This makes it possible for unauthenticated attackers to save custom...
PT-2023-24674 · Avo · Avo
Name of the Vulnerable Software and Affected Versions: Avo affected versions not specified Description: The issue concerns some Avo fields being vulnerable to Cross Site Scripting XSS when rendering HTML-based content. Attackers need form edit privilege to exploit this vulnerability, but the...
Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title
Exploit Title: Authenticated Persistent XSS in Cameleon CMS 2.7.4 Google Dork: intext:"Camaleon CMS is a free and open-source tool and a fexible content management system CMS based on Ruby on Rails" Date: 2023-10-05 Exploit Author: Yasin Gergin Vendor Homepage: http://camaleon.tuzitio.com Softwar...
Cameleon CMS 2.7.4 - Persistent Stored XSS in Post Title Vulnerability
Exploit Title: Authenticated Persistent XSS in Cameleon CMS 2.7.4 Google Dork: intext:"Camaleon CMS is a free and open-source tool and a fexible content management system CMS based on Ruby on Rails" Exploit Author: Yasin Gergin Vendor Homepage: http://camaleon.tuzitio.com Software Link:...
curl: CVE-2023-28322: more POST-after-PUT confusion
A vulnerability existed in libcurl that allowed an attacker to inject unintended data or cause a segfault by confusing the POST and PUT methods. The previous fix for this vulnerability was insufficient as it only corrected the CURLOPTPOST option, which is not always used when sending data with th...