CVE-2022-25612

Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities in Simple Event Planner WordPress plugin = 1.5.4 allows user with author or higher user rights inject the malicious code via vulnerable parameters: eventorganiser, organiseremail, organisercontact...

CVE-2022-25611

Authenticated Stored Cross-Site Scripting XSS in Simple Event Planner plugin = 1.5.4 allows attackers with contributor or higher user roles to inject the malicious script by using vulnerable parameter addseg...

Prototype Pollution

simple-plist is vulnerable to prototype pollution. The vulnerability exists because the validations are not handled properly which allows an attacker to inject properties into existing construct prototypes and modify attributes via .parse function...

@cerebroapp/cerebro-shell (>=1.0.0-alpha.1, <=1.0.0), @cerebroapp/cerebro-ui (>=2.0.0-alpha.3, <=2.0.0-alpha.4) +4 more potentially affected by CVE-2022-26260 via simple-plist (>=1.1.0, <=1.1.1)

simple-plist NPM version =1.1.0, =1.0.0-alpha.1, =2.0.0-alpha.3, =0.1.0, =1.0.143, =1.0.46, =4.0.0-beta.0 Source cves: CVE-2022-26260 Source advisory: OSV:GHSA-GFF7-G5R8-MG8M...

GHSA-GFF7-G5R8-MG8M Prototype Pollution in simple-plist

simple-plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse...

Prototype Pollution in simple-plist

simple-plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse...

WordPress Simple Event Planner plugin <= 1.5.4 - Multiple Authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities

Multiple Authenticated Persistent Cross-Site Scripting XSS vulnerabilities discovered by Ex.Mi Patchstack in WordPress Simple Event Planner plugin versions = 1.5.4. Solution Update the WordPress Simple Event Planner plugin to the latest available version at least 1.5.5...

WordPress Simple Event Planner plugin <= 1.5.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress Simple Event Planner plugin versions = 1.5.4. Solution Update the WordPress Simple Event Planner plugin to the latest available version at least 1.5.5...

CVE-2022-26260

Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse...

CVE-2022-26260

Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse...

Code injection

Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse...

CVE-2022-26260

Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse...

CVE-2022-26260

CVE-2022-26260 affects Simple-Plist v1.3.0. The Red Hat, Veracode, and OSV entries, plus CVE records, confirm a prototype-pollution vulnerability in the library exposed via the .parse() function. Root cause: improper handling during parsing that allows injection of properties into construct proto...

CVE-2022-26260

Simple-Plist v1.3.0 was discovered to contain a prototype pollution vulnerability via .parse...

Simple-Plist 安全漏洞

Simple-Plist is a simple API for interacting with binary and plain text Plist data from Joe Wollard, a personal developer in the US. A security vulnerability exists in wollardj Simple-Plist v1.3.0, which stems from a prototype contamination vulnerability in .parse...

CVE-2022-26283

Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the viewplan endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests...

CVE-2022-26285

Simple Subscription Website v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the apply endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests...

CVE-2022-26284

Simple Client Management System v1.0 was discovered to contain a SQL injection vulnerability via the id parameter in the manageclient endpoint. This vulnerability allows attackers to dump the application's database via crafted HTTP requests...

CVE-2022-0760

The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the postid parameter before using it in a SQL statement via the qcopdupvoteaction AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL Injection...

CVE-2022-0760

The Simple Link Directory WordPress plugin before 7.7.2 does not validate and escape the postid parameter before using it in a SQL statement via the qcopdupvoteaction AJAX action available to unauthenticated and authenticated users, leading to an unauthenticated SQL Injection...