CVE-2025-23531

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in davidfcarr RSVPMaker Volunteer Roles rsvpmaker-volunteer-roles allows Reflected XSS.This issue affects RSVPMaker Volunteer Roles: from n/a through = 1.5.1...

CVE-2025-23531

CVE-2025-23531 is a Reflected XSS in the RSVPMaker Volunteer Roles WordPress plugin. The vulnerability arises from improper neutralization of input during web page generation, affecting RSVPMaker Volunteer Roles versions from n/a through 1.5.1. The CVSS v3.1 score is 7.1 (HIGH) with NETWORK attac...

CVE-2025-23531 WordPress RSVPMaker Volunteer Roles plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in davidfcarr RSVPMaker Volunteer Roles rsvpmaker-volunteer-roles allows Reflected XSS.This issue affects RSVPMaker Volunteer Roles: from n/a through = 1.5.1...

PT-2025-4925 · Unknown · Rsvpmaker Volunteer Roles

Name of the Vulnerable Software and Affected Versions: RSVPMaker Volunteer Roles versions 1.5.1 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows reflected Cross-site Scripting XSS. This enables attackers to inject malicious...

WordPress plugin RSVPMaker Volunteer Roles 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the /admin/auth/roles component due to improper sanitization of the Slug field. An attacker can inject malicious scripts by sending crafted inputs to the affected page. Details...

CVE-2025-0709

CVE-2025-0709 affects Dcat-Admin 2.2.1-beta, specifically the Roles Page component at /admin/auth/roles. Root cause: cross-site scripting (XSS) via manipulation of input on that page; exploitation can be remote and has been disclosed publicly. Multiple sources (NVD, Red Hat, OSV, CVELIST, vulnbod...

CVE-2025-0709 Dcat-Admin Roles Page roles cross site scripting

A vulnerability was found in Dcat-Admin 2.2.1-beta. It has been rated as problematic. This issue affects some unknown processing of the file /admin/auth/roles of the component Roles Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2025-0709 Dcat-Admin Roles Page roles cross site scripting

A vulnerability was found in Dcat-Admin 2.2.1-beta. It has been rated as problematic. This issue affects some unknown processing of the file /admin/auth/roles of the component Roles Page. The manipulation leads to cross site scripting. The attack may be initiated remotely. The exploit has been...

CVE-2025-0699

A vulnerability was found in JoeyBling bootplus up to 247d5f6c209be1a5cf10cd0fa18e1d8cc63cf55d. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /admin/sys/role/list. The manipulation of the argument sort leads to sql injection. The attack c...

dcat-admin 代码注入漏洞

dcat-admin is a Laravel-based back-end system builder by Jiang Qinghua, an individual developer. A code injection vulnerability exists in dcat-admin version 2.2.1-beta, which originates from the component Roles Page's file /admin/auth/roles that can lead to cross-site scripting...

PT-2025-4018 · Unknown · Dcat-Admin

Name of the Vulnerable Software and Affected Versions: Dcat-Admin version 2.2.1-beta Description: A flaw was found in the Roles Page component of Dcat-Admin, specifically in the file /admin/auth/roles. This issue can be manipulated to lead to cross-site scripting XSS and can be initiated remotely...

PT-2025-5336 · Directus · Directus

Name of the Vulnerable Software and Affected Versions: Directus versions prior to 11.2.0 Description: The issue allows a typical user to specify an arbitrary role when sharing an item, enabling them to use a higher-privileged role to view fields they should not be able to see. This affects...

Directus 安全漏洞

Directus is a real-time Api and application dashboard open-sourced by Directus. It is used to manage Sql database content. A security vulnerability exists in Directus versions prior to 11.2.0 that stems from the ability of a user to specify arbitrary roles when sharing a project, resulting in a...

CVE-2024-9020 List category posts < 0.90.3 - Author+ Stored XSS

The List category posts WordPress plugin before 0.90.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...

CVE-2025-23528

Incorrect Privilege Assignment vulnerability in Mosterd3d DD Roles dd-roles allows Privilege Escalation.This issue affects DD Roles: from n/a through = 4.1...

CVE-2025-23528

CVE-2025-23528 describes an Incorrect Privilege Assignment in the WordPress plugin DD Roles (by Wouter Dijkstra) that enables authenticated privilege escalation. Affected: DD Roles up to version 4.1. The vulnerability is rated with CVSS 3.1/3.1: Base score 8.8 (High), vectors: AV:N/AC:L/PR:L/UI:N...

CVE-2025-23528 WordPress DD Roles plugin <= 4.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Mosterd3d DD Roles dd-roles allows Privilege Escalation.This issue affects DD Roles: from n/a through = 4.1...

CVE-2025-23528 WordPress DD Roles plugin <= 4.1 - Privilege Escalation vulnerability

Incorrect Privilege Assignment vulnerability in Mosterd3d DD Roles dd-roles allows Privilege Escalation.This issue affects DD Roles: from n/a through = 4.1...

WordPress RSVPMaker Volunteer Roles plugin <= 1.5.1 - Reflected Cross Site Scripting (XSS) vulnerability

Reflected Cross Site Scripting XSS vulnerability discovered by João Pedro Soares de Alcântara Kinorth in WordPress Plugin RSVPMaker Volunteer Roles versions = 1.5.1...