CVE-2026-81655: Improper Control of Generation of Code

The Ad Inserter WordPress plugin before 2.8.19 does not correctly restrict access to one of its settings pages, making it reachable by every logged in user under a configuration its own settings allow, and does not filter the content saved there, allowing users with a role as low as subscriber to...

CVE-2026-30701

The Yuner Yipu WiFi Extender WDR201A (HW V2.1, FW LFMZX28040922V1.02) is vulnerable to hardcoded credential disclosure via its web interface. Multiple server-side web pages, specifically login.shtml and settings.shtml , contain Server Side Include (SSI) mechanisms. These pages embed execution dir...

EUVD-2016-1862

Malware in sbrugna...

BIT-MYBB-2021-43281

MyBB before 1.8.29 allows Remote Code Injection by an admin with the "Can manage settings?" permission. The Admin CP's Settings management module does not validate setting types correctly on insertion and update, making it possible to add settings of supported type "php" with PHP code, executed o...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on PHP and MySQL servers.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in the WordPress...

WordPress Popup Builder 跨站脚本漏洞

WordPress Popup Builder is a WordPress open source application. Increase conversions and drive sales while achieving marketing goals. Popup Builder suffers from a cross-site scripting vulnerability that stems from the vulnerability of all subscriber settings pages to cross-site scripting...

CVE-2020-6999

In Moxa EDS-G516E Series firmware, Version 5.2 or lower, some of the parameters in the setting pages do not ensure text is the correct size for its buffer...

PT-2020-18992

Name of the Vulnerable Software and Affected Versions SAP Business Objects Business Intelligence Platform CMC version 4.2 Description The issue concerns certain settings pages in the SAP Business Objects Business Intelligence Platform CMC that generate error messages. These error messages can...

CVE-2019-15037: Improper Neutralization of Input During Web Page Generation

An issue was discovered in JetBrains TeamCity 2018.2.4. It had several XSS vulnerabilities on the settings pages. The issues were fixed in TeamCity 2019.1...

PT-2019-13946

Name of the Vulnerable Software and Affected Versions JetBrains TeamCity versions 2018.2.4 and earlier Description An issue was discovered in JetBrains TeamCity, which had several XSS vulnerabilities on the settings pages. Recommendations For JetBrains TeamCity version 2018.2.4, update to TeamCit...

CVE-2016-10867

The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages...

CVE-2016-10867

The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages...

PT-2019-7663 · WordPress · All-In-One-Wp-Security-And-Firewall

Name of the Vulnerable Software and Affected Versions: all-in-one-wp-security-and-firewall plugin versions prior to 4.0.6 Description: The issue concerns a cross-site scripting XSS problem in the settings pages of the plugin. Recommendations: For versions prior to 4.0.6, update to version 4.0.6 o...

CVE-2016-10867: Improper Neutralization of Input During Web Page Generation

The all-in-one-wp-security-and-firewall plugin before 4.0.6 for WordPress has XSS in settings pages...