300 matches found
CVE-2021-39334: Improper Neutralization of Input During Web Page Generation
The Job Board Vanila WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient input validation and sanitization via the psjbexpin and the psjbcurrin parameters found in the /job-settings.php file which allowed attackers with administrative user access to inject arbitrary...
CVE-2021-38332: Improper Neutralization of Input During Web Page Generation
The On Page SEO + Whatsapp Chat Button Plugin WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.1...
CVE-2021-38327: Improper Neutralization of Input During Web Page Generation
The YouTube Video Inserter WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to a reflected $SERVER"PHPSELF" value in the /adminUI/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2.1.0...
CVE-2021-34642
The CVE-2021-34642 entry concerns the WordPress Smart Email Alerts plugin (versions up to 1.0.10) vulnerable to Reflected Cross-Site Scripting via the api_key in ~/views/settings.php. The underlying issue allows injection of arbitrary scripts, with network access and user interaction required (CV...
CVE-2021-34642: Improper Neutralization of Input During Web Page Generation
The Smart Email Alerts WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the apikey in the /views/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.10...
CVE-2021-36601: Improper Neutralization of Input During Web Page Generation
GetSimpleCMS 3.3.16 contains a cross-site Scripting XSS vulnerability, where Function TSL does not filter check settings.php Website URL: "siteURL" parameter...
CVE-2021-34637 Post Index <= 0.7.5 Cross-Site Request Forgery to Stored Cross-Site Scripting
The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the /php/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.5...
CVE-2021-34637
The CVE-2021-34637 item applies to the WordPress Post Index plugin, affected through CSRF via the OptionsPage in php/settings.php, with vulnerable versions up to 0.7.5. Public references describe an attacker who can inject arbitrary web scripts, resulting in stored XSS, via a CSRF flaw. Connected...
CVE-2021-34637: Cross-Site Request Forgery (CSRF)
The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the /php/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.5...
CVE-2021-34635: Improper Neutralization of Input During Web Page Generation
The Poll Maker WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the mcount parameter found in the /admin/partials/settings/poll-maker-settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.8...
WordPress 插件 跨站请求伪造漏洞
WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress plugin, which stems from the vulnerability to cross-site request forgery via the OptionsPage function in the php settings.php file, which allows an attacker to inject arbitrary we...
Cross site scripting
Cross Site Scriptiong XSS vulnerability in GetSimpleCMS =3.3.15 via the timezone parameter to settings.php...
CVE-2020-18658: Improper Neutralization of Input During Web Page Generation
Cross Site Scriptiong XSS vulnerability in GetSimpleCMS =3.3.15 via the timezone parameter to settings.php...
CVE-2020-18889: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF vulnerability in puppyCMS v5.1 that can change the admin's password via /admin/settings.php...
CVE-2021-28418
A cross-site scripting XSS issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter...
CVE-2021-28418
A cross-site scripting XSS issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter...
Cross site scripting
A cross-site scripting XSS issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter...
CVE-2021-28418
A cross-site scripting XSS issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter...
CVE-2021-28418: Improper Neutralization of Input During Web Page Generation
A cross-site scripting XSS issue in Seo Panel 4.8.0 allows remote attackers to inject JavaScript via settings.php and the "category" parameter...
CVE-2020-14971: Missing Authorization
Pi-hole through 5.0 allows code injection in piholedhcp the Static DHCP Leases section by modifying Teleporter backup files and then restoring them. This occurs in settings.php. To exploit this, an attacker would request a backup of limited files via teleporter.php. These are placed into a .tar.g...