Playlist for Youtube <= 1.32 - Editor+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Go to...

CVE-2024-20866

Authentication bypass vulnerability in Setupwizard prior to SMR May-2024 Release 1 allows physical attackers to skip activation step...

CVE-2024-3755

The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3755

The MF Gig Calendar WordPress plugin through 1.2.1 does not sanitise and escape some of its settings, which could allow high privilege users such as editor to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-0904

The Fancy Product Designer WordPress plugin before 6.1.81 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3752 Crelly Slider <= 1.4.5 - Admin+ Stored XSS

The Crelly Slider WordPress plugin through 1.4.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2024-3755

The MF Gig Calendar WordPress plugin, affecting versions 1.2.1 and earlier , is vulnerable to a Stored Cross-Site Scripting (XSS) attack. The root cause is the failure to properly sanitize and escape certain plugin settings. This allows high-privilege users, such as editors , to perform XSS attac...

CVE-2024-0904

The Fancy Product Designer WordPress plugin, in versions prior to 6.1.81 , is vulnerable to Stored Cross-Site Scripting (XSS) due to a failure to properly sanitise and escape certain settings. This flaw allows high-privilege users, such as administrators, to execute XSS attacks, even in environme...

CVE-2023-41821

A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information...

CVE-2023-41821

A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information...

CVE-2023-41821

The CVE-2023-41821 entry concerns the Motorola Setup application and describes an improper export vulnerability that could allow a local attacker to read sensitive user information. The issue affects the Motorola Setup component and is driven by an export handling flaw that exposes sensitive data...

CVE-2024-3637

The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2024-3637 Responsive Contact Form Builder & Lead Generation Plugin <= 1.8.9 - Admin+ Stored XSS

The Responsive Contact Form Builder & Lead Generation Plugin WordPress plugin through 1.8.9 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2023-41201

D-Link DAP-1325 HNAP SetSetupWizardStatus Enabled Command Injection Remote Code Execution Vulnerability. This vulnerability allows network-adjacent attackers to execute arbitrary code on affected installations of D-Link DAP-1325 routers. Authentication is not required to exploit this vulnerabilit...

D-Link DAP-1325 security vulnerability

The D-Link DAP-1325 is a wireless access point/bridge from China's AUO D-Link that is primarily used to provide wireless network coverage and has a bridging feature that can convert a wired network to a wireless network or connect two wireless networks together. A security vulnerability exists in...

Motorola Setup security vulnerabilities

Motorola Setup is an installation application from Motorola USA. A security vulnerability exists in Motorola Setup that stems from an incorrect export vulnerability that allows a local attacker to read sensitive user information...

CVE-2023-41821: Improper Export of Android Application Components

A an improper export vulnerability was reported in the Motorola Setup application that could allow a local attacker to read sensitive user information...

PT-2024-12985 · Motorola · Motorola Setup

Name of the Vulnerable Software and Affected Versions: Motorola Setup application affected versions not specified Description: An improper export vulnerability was reported in the Motorola Setup application, allowing a local attacker to read sensitive user information. Recommendations: At the...

CVE-2024-26994

In the Linux kernel, the following vulnerability has been resolved: speakup: Avoid crash on very long word In case a console is set up really large and contains a really long word 256 characters, we have to stop before the length of the word buffer...

IDonate <= 1.9.0 - Admin+ Stored XSS

Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup PoC 1. Navigate to...