CVE-2024-10836

CVE-2024-10836 affects the Flixita WordPress theme (all versions up to 1.0.82). It is a Reflected Cross-Site Scripting vulnerability via the id parameter caused by insufficient input sanitization and output escaping, allowing unauthenticated attackers to inject scripts in pages executed after use...

PT-2024-17002 · WordPress · Onlyoffice Docs

Name of the Vulnerable Software and Affected Versions: ONLYOFFICE Docs plugin for WordPress versions up to, and including, 2.0.0 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'onlyoffice' shortcode due to insufficient input sanitization and output escaping on...

PT-2024-16615 · WordPress · Luna Radio Player

Name of the Vulnerable Software and Affected Versions: LUNA RADIO PLAYER plugin for WordPress versions up to, and including, 6.24.11.07 Description: The issue is related to Stored Cross-Site Scripting via the 'lunaradio' shortcode due to insufficient input sanitization and output escaping on...

Cross-Site Scripting (XSS)

librenms/librenms is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization of the "name" parameter on the "Port Settings" page, allowing an attacker to inject arbitrary JavaScript, which executes when the page is accessed, potentially compromising user...

Cross Site Scripting (XSS)

librenms/librenms is vulnerable to cross-site scripting XSS. The vulnerability is due to improper input sanitization in the device Display Name field, allowing JavaScript code to execute from various sources...

PT-2024-16331 · Netfunkdesign · Adbuddy+

Name of the Vulnerable Software and Affected Versions: adBuddy+ AdBlocker Detection by NetfunkDesign WordPress plugin versions 1.1.3 and earlier Description: The issue concerns a Stored Cross-Site Scripting attack that can be performed by high-privilege users, such as admins, due to the plugin's...

CVE-2024-11234 Configuring a proxy in a stream context might allow for CRLF injection in URIs

In PHP versions 8.1. before 8.1.31, 8.2. before 8.2.26, 8.3. before 8.3.14, when using streams with configured proxy and "requestfulluri" option, the URI is not properly sanitized which can lead to HTTP request smuggling and allow the attacker to use the proxy to perform arbitrary HTTP requests...

CBL Mariner 2.0 Security Update: nodejs / nodejs18 / reaper (CVE-2024-21538)

The version of nodejs / nodejs18 / reaper installed on the remote CBL Mariner 2.0 host is prior to tested version. It is, therefore, affected by a vulnerability as referenced in the CVE-2024-21538 advisory. - Versions of the package cross-spawn before 6.0.6, from 7.0.0 and before 7.0.5 are...

DRUPAL-CORE-2024-003

Drupal uses JavaScript to render status messages in some cases and configurations. In certain situations, the status messages are not adequately sanitized...

LibreNMS has a Stored XSS ('Cross-site Scripting') in librenms/includes/html/dev-overview-data.inc.php

Summary A Stored Cross-Site Scripting XSS vulnerability in the Device Overview page allows authenticated users to inject arbitrary JavaScript through the "overwriteip" parameter when editing a device. This vulnerability results in the execution of malicious code when the device overview page is...

PT-2024-38653 · WordPress · The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin

Name of the Vulnerable Software and Affected Versions: The Appointment Booking Calendar — Simply Schedule Appointments Booking Plugin WordPress plugin versions prior to 1.6.7.55 Description: The issue is related to the lack of sanitization and escaping of some Notification settings in the plugin,...

PT-2024-39666 · WordPress · The Beaver Builder

Name of the Vulnerable Software and Affected Versions: The Beaver Builder – WordPress Page Builder plugin versions up to, and including, 2.8.4.2 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the plugin's Button widget, allowi...

PT-2024-39910 · WordPress · T(-) Countdown

Name of the Vulnerable Software and Affected Versions: T- Countdown plugin for WordPress versions up to, and including, 2.4.8 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the tminus shortcode, allowing authenticated attacker...

PT-2024-10574

Name of the Vulnerable Software and Affected Versions MainWP Dashboard – The Private WordPress Manager for Multiple Website Maintenance plugin for WordPress versions up to, and including, 3.1.2 Description The issue is related to Stored Cross-Site Scripting, which occurs due to insufficient input...

Ubuntu: Security Advisory (USN-7061-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Cross-site Scripting (XSS)

LimeSurvey is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper input sanitization, allowing a remote attacker to execute arbitrary code by injecting a crafted script into the title and comment fields...

PT-2024-37279 · 10Web · The Photo Gallery

Name of the Vulnerable Software and Affected Versions: The Photo Gallery by 10Web WordPress plugin versions prior to 1.8.28 Description: The issue concerns a Stored Cross-Site Scripting attack. High privilege users, such as admins, can exploit this even when the unfiltered html capability is...

UBUNTU-CVE-2024-43362

Cacti is an open source performance and fault management framework. The fileurl parameter is not properly sanitized when saving external links in links.php . Morever, the said fileurl is placed in some html code which is passed to the print function in link.php and index.php, finally leading to...

Cross Site Scripting(XSS)

librenms/librenms is vulnerable to Cross Site ScriptingXSS. The vulnerability is due to improper input sanitization in the Device Groups name, allowing JavaScript code to be executed when the details of the Device Group are viewed...

PT-2024-39446 · WordPress · Svg Complete

Name of the Vulnerable Software and Affected Versions: SVG Complete plugin for WordPress versions up to, and including, 1.0.2 Description: The issue is related to Stored Cross-Site Scripting via SVG File uploads due to insufficient input sanitization and output escaping. This allows authenticated...