CVE-2026-7294

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function savesettings of the file /admin/index.php?page=savesettings. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit h...

CVE-2026-7294: Improper Neutralization of Input During Web Page Generation

A flaw has been found in SourceCodester Pizzafy Ecommerce System 1.0. Affected by this vulnerability is the function savesettings of the file /admin/index.php?page=savesettings. This manipulation of the argument Name causes cross site scripting. The attack may be initiated remotely. The exploit h...

CVE-2026-1993: Improper Privilege Management

The ExactMetrics – Google Analytics Dashboard for WordPress plugin is vulnerable to Improper Privilege Management in versions 7.1.0 through 9.0.2. This is due to the updatesettings function accepting arbitrary plugin setting names without a whitelist of allowed settings. This makes it possible fo...

CVE-2025-12373: Cross-Site Request Forgery (CSRF)

The Torod – The smart shipping and delivery portal for e-shops and retailers plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.9. This is due to missing or incorrect nonce validation on the savesettings function. This makes it possible for...

CVE-2025-6422: Unrestricted Upload of File with Dangerous Type

A vulnerability classified as critical was found in Campcodes Online Recruitment Management System 1.0. Affected by this vulnerability is an unknown functionality of the file /admin/ajax.php?action=savesettings of the component About Content Page. The manipulation of the argument img leads to...

CVE-2025-3919: Improper Neutralization of Input During Web Page Generation

The WordPress Comments Import & Export plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savesettings function in all versions up to, and including, 2.4.3. Additionally, the plugin fails to properly sanitize and escape FTP settings...

CVE-2025-1682: Missing Authorization

The Cardealer theme for WordPress is vulnerable to privilege escalation in versions up to, and including, 1.6.4 due to missing capability check on the 'savesettings' function. This makes it possible for authenticated attackers, with subscriber-level access and above, to modify the default user ro...

CVE-2024-12249: Missing Authorization

The GS Insever Portfolio plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the savesettings function in all versions up to, and including, 1.4.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, ...

CVE-2024-12253: Missing Authorization

The Simple Ecommerce Shopping Cart Plugin- Sell products through Paypal plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on the 'savesettings', 'exportcsv', and 'simpleecommcart-action' actions in all versions up to, and including, 3.1.2. This makes it...

CVE-2024-46377

Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the savesettings function of the file rental/adminclass.php...

CVE-2024-46377: Unrestricted Upload of File with Dangerous Type

Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the savesettings function of the file rental/adminclass.php...

CVE-2024-46377

Best House Rental Management System 1.0 contains an arbitrary file upload vulnerability in the savesettings function of the file rental/adminclass.php...

CVE-2023-3408

CVE-2023-3408 affects the Bricks theme for WordPress. The vulnerability is a CSRF flaw caused by missing/incorrect nonce validation in the save_settings function, allowing unauthenticated attackers to modify theme settings. This could enable a setting that lets low-privileged users (e.g., contrib...

CVE-2023-3408 Bricks <= 1.8.1 - Cross-Site Request Forgery via save_settings

The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'savesettings' function. This makes it possible for unauthenticated attackers to modify the theme's settings, including...

CVE-2023-3408: Cross-Site Request Forgery (CSRF)

The Bricks theme for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.8.1. This is due to missing or incorrect nonce validation on the 'savesettings' function. This makes it possible for unauthenticated attackers to modify the theme's settings, including...

CVE-2024-7500

A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been rated as critical. Affected by this issue is the function savesettings of the file admin/adminclass.php. The manipulation of the argument img leads to unrestricted upload. The attack may be launched remotely. Th...

CVE-2024-7500 itsourcecode Airline Reservation System admin_class.php save_settings unrestricted upload

A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been rated as critical. Affected by this issue is the function savesettings of the file admin/adminclass.php. The manipulation of the argument img leads to unrestricted upload. The attack may be launched remotely. Th...

CVE-2024-7500: Unrestricted Upload of File with Dangerous Type

A vulnerability was found in itsourcecode Airline Reservation System 1.0. It has been rated as critical. Affected by this issue is the function savesettings of the file admin/adminclass.php. The manipulation of the argument img leads to unrestricted upload. The attack may be launched remotely. Th...

CVE-2024-7284: Improper Neutralization of Input During Web Page Generation

A vulnerability, which was classified as problematic, was found in SourceCodester Lot Reservation Management System 1.0. This affects an unknown part of the file /admin/ajax.php?action=savesettings. The manipulation of the argument about leads to cross site scripting. It is possible to initiate t...

CVE-2024-7285: Improper Neutralization of Input During Web Page Generation

A vulnerability has been found in SourceCodester Establishment Billing Management System 1.0 and classified as problematic. This vulnerability affects unknown code of the file /admin/ajax.php?action=savesettings. The manipulation of the argument name leads to cross site scripting. The attack can ...