CVE-2024-13419: Missing Authorization

Multiple plugins and/or themes for WordPress using Smart Framework are vulnerable to Stored Cross-Site Scripting due to a missing capability check on the saveOptions and importThemeOptions functions in various versions. This makes it possible for authenticated attackers, with Subscriber-level...

CVE-2025-2340

A vulnerability was found in otale Tale Blog 2.0.5. It has been declared as problematic. This vulnerability affects the function saveOptions of the file /options/save of the component Site Settings. The manipulation of the argument Site Title leads to cross site scripting. The attack can be...

CVE-2025-2340: Improper Neutralization of Input During Web Page Generation

A vulnerability was found in otale Tale Blog 2.0.5. It has been declared as problematic. This vulnerability affects the function saveOptions of the file /options/save of the component Site Settings. The manipulation of the argument Site Title leads to cross site scripting. The attack can be...

PT-2025-11392

Name of the Vulnerable Software and Affected Versions otale Tale Blog version 2.0.5 Description A vulnerability was found in otale Tale Blog, affecting the function saveOptions of the file /options/save of the component Site Settings. The manipulation of the argument Site Title leads to cross-sit...

CVE-2009-4563

Cross-site request forgery CSRF vulnerability in zp-core/admin-options.php in Zenphoto 1.2.5 allows remote attackers to hijack the authentication of administrators for requests that change the administrative password via the 0-adminpass and 0-adminpass2 parameters in a saveoptions action...

CVE-2009-4563

CVE-2009-4563 describes a CSRF vulnerability in Zenphoto 1.2.5, specifically in zp-core/admin-options.php. The issue allows remote attackers to hijack an administrator’s session and trigger password changes via the 0-adminpass and 0-adminpass_2 parameters in a saveoptions action. The connected do...