413 matches found
WordPress plugin Themify Shortcodes 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation, a blogging platform developed in PHP. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security vulnerability exists in the WordPress plugi...
PT-2024-2110 · Jenkins · Jenkins Html Publisher Plugin +1
Name of the Vulnerable Software and Affected Versions: Jenkins HTML Publisher Plugin versions 1.16 through 1.32 Description: The issue arises from the plugin's failure to properly sanitize input, allowing attackers with Item/Configure permission to implement cross-site scripting XSS attacks. This...
CVE-2023-38318
An issue was discovered in OpenNDS before 10.1.3. It fails to sanitize the gateway FQDN entry in the configuration file, allowing attackers that have direct or indirect access to this file to execute arbitrary OS commands...
CVE-2023-5558
The LearnPress WordPress plugin before 4.2.5.5 does not sanitise and escape user input before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
The vulnerability of the hedwig.cgi file in the D-LINK GO-RT-AC750 router microprogramming system allows a hacker to execute any command they desire.
The vulnerability of the hedwig.cgi file of the D-LINK GO-RT-AC750 router’s microprogramming system is related to the lack of measures for cleaning incoming data. Exploiting this vulnerability allows a remote attacker to execute arbitrary commands...
CVE-2023-44373
Affected devices do not properly sanitize an input field. This could allow an authenticated remote attacker with administrative privileges to inject code or spawn a system root shell. Follow-up of CVE-2022-36323...
CVE-2023-4858
The Simple Table Manager WordPress plugin through 1.5.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
CVE-2023-2256
The Product Addons & Fields for WooCommerce WordPress plugin before 32.0.7 does not sanitize and escape some URL parameters, leading to Reflected Cross-Site Scripting...
CVE-2023-1384
The setMediaSource function on the amzn.thin.pl service does not sanitize the "source" parameter allowing for arbitrary javascript code to be run This issue affects: Amazon Fire TV Stick 3rd gen versions prior to 6.2.9.5. Insignia TV with FireOS versions prior to 7.6.3.3...
CVE-2023-0422
The Article Directory WordPress plugin through 1.3 does not properly sanitize the publishtermstext setting before displaying it in the administration panel, which may enable administrators to conduct Stored XSS attacks in multisite contexts...
Mozilla: Malicious command could be hidden in devtools output
The Mozilla Foundation Security Advisory describes this flaw as: When copying a network request from the developer tools panel as a curl command the output was not being properly sanitized and could allow arbitrary commands to be hidden within...
CVE-2022-4442
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example, i...
UBUNTU-CVE-2023-0302
Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository radareorg/radare2 prior to 5.8.2...
Cross-Site Scripting (XSS)
claviska/jquery-minicolors is vulnerable to cross-site scripting. The vulnerability exists because of the lack of sanitization in the name attribute in jquery.minicolors.min.js, allowing an attacker to inject and execute malicious JavaScript...
PT-2022-26962 · Unknown · Concrete Cms
Name of the Vulnerable Software and Affected Versions: Concrete CMS versions below 8.5.10 Concrete CMS versions 9.0.0 through 9.1.2 Description: The issue concerns a lack of sanitization in the result dashboard page output for text input fields, leading to a potential XSS vulnerability. The...
CVE-2022-3462
The Highlight Focus WordPress plugin through 1.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
PYSEC-2022-42975
Failure to Sanitize Special Elements into a Different Plane Special Element Injection in GitHub repository octoprint/octoprint prior to 1.8.3...
CVE-2022-3136
The Social Rocket WordPress plugin before 1.3.3 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...
UBUNTU-CVE-2022-2628
The DSGVO All in one for WP WordPress plugin before 4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...