12397 matches found
Simple Machines Forum (SMF) < 2.0.17 SSRF Vulnerability
Simple Machines Forum SMF is prone to a server-side request forgery SSRF vulnerability. SPDX-FileCopyrightText: 2020 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
Simple Machines Forum Code Issue Vulnerability
Simple Machines Forum SMF is an open source web forum system by the SMF team in the United States. A code issue vulnerability exists in Simple Machines Forum SMF release prior to version 2.0.17. No details of the vulnerability are available at this time...
WordPress Simple Link Directory Cross-Site Scripting Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Simple Link Directory is a directory plugin used in it. A cross-site scripting vulnerability exists in the qcopd-shortcode-generator.ph...
CVE-2019-11574
An issue was discovered in Simple Machines Forum SMF before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls...
CVE-2019-11574
An issue was discovered in Simple Machines Forum SMF before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls...
Server side request forgery (ssrf)
An issue was discovered in Simple Machines Forum SMF before release 2.0.17. There is SSRF related to Subs-Package.php and Subs.php because user-supplied data is used directly in curl calls...
CVE-2019-11574
Simple Machines Forum (SMF) prior to release 2.0.17 is affected by a server-side request forgery (SSRF) in Subs-Package.php and Subs.php, where user-supplied data is used directly in curl calls. Affects SMF versions before 2.0.17; CVE-2019-11574 details an SSRF condition with high impact per CVSS...
CVE-2019-13463
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because eschtml is not called for the "echo getthetitle" or "echo $term-name" statement...
CVE-2019-13463
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because eschtml is not called for the "echo getthetitle" or "echo $term-name" statement...
Cross site scripting
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because eschtml is not called for the "echo getthetitle" or "echo $term-name" statement...
CVE-2019-13463
CVE-2019-13463 describes an XSS vulnerability in the WordPress plugin Simple Link Directory (qcopd-shortcode-generator.php) prior to version 7.3.5. The root cause is that esc_html is not applied to the output statements, specifically echo get_the_title() and echo $term->name , allowing remote ...
CVE-2019-13463
An XSS vulnerability in qcopd-shortcode-generator.php in the Simple Link Directory plugin before 7.3.5 for WordPress allows remote attackers to inject arbitrary web script or HTML, because eschtml is not called for the "echo getthetitle" or "echo $term-name" statement...
CVE-2020-10682
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1files to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code it need not be a valid JPEG file...
CVE-2020-10682
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1files to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code it need not be a valid JPEG file...
CVE-2020-10681
The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1files to admin/moduleinterface.php...
CVE-2020-10681
The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1files to admin/moduleinterface.php...
Cross site scripting
The Filemanager in CMS Made Simple 2.2.13 has stored XSS via a .pxd file, as demonstrated by m1files to admin/moduleinterface.php...
CVE-2020-10682
CMS Made Simple Filemanager in version 2.2.13 is vulnerable to remote code execution via a crafted .php.jpegd JPEG file. An attacker can deliver PHP code by uploading a file (sent as application/octet-stream) and triggering it through admin/moduleinterface.php (e.g., using m1_files[]) to execute ...
CVE-2020-10682
The Filemanager in CMS Made Simple 2.2.13 allows remote code execution via a .php.jpegd JPEG file, as demonstrated by m1files to admin/moduleinterface.php. The file should be sent as application/octet-stream and contain PHP code it need not be a valid JPEG file...
CVE-2020-10681
Summary: CVE-2020-10681 affects CMS Made Simple 2.2.13, specifically the Filemanager component, which is vulnerable to stored XSS via a .pxd file, demonstrated via m1_files[] to admin/moduleinterface.php. What’s affected: CMS Made Simple Filemanager in version 2.2.13. Root cause / vector (as stat...