PT-2026-107770

This module enables you to audit a Drupal site by generating reports about its content, entities, display modes and configuration. The module doesn't sufficiently check entity access when rendering an entity through the display-mode example route. This allows an attacker to view unpublished or...

EUVD-2021-11357

Malware in sbrugna...

CVE-2021-24445

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

WordPress My Site Audit plugin <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Akash Rajendra Patil in WordPress My Site Audit plugin versions = 1.2.4. Solution Update the WordPress My Site Audit plugin to the latest available version at least 1.2.5...

CVE-2021-24445

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

Cross site scripting

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

CVE-2021-24445

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

CVE-2021-24445

CVE-2021-24445 affects the WordPress My Site Audit plugin up to version 1.2.4. The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) caused by failure to sanitize/escape the Audit Name field when creating audits, allowing a high-privilege user to inject JavaScript payloads even ...

CVE-2021-24445: Improper Neutralization of Input During Web Page Generation

The My Site Audit WordPress plugin through 1.2.4 does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting...

PT-2021-15973

Name of the Vulnerable Software and Affected Versions My Site Audit WordPress plugin versions 1.2.4 and earlier Description The issue allows high privilege users to set JavaScript payloads in the Audit Name field when creating an audit, due to a lack of sanitization or escaping, leading to an...

My Site Audit <= 1.2.4 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise or escape the Audit Name field when creating an audit, allowing high privilege users to set JavaScript payloads in them, even when he unfilteredhtml capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue PoC Create an audit with the...

Semrush: SSRF and LFI in site-audit tool

SSRF and LFI vulnerability in Site Audit due to lack of connection protocol verification...

Semrush: XXE in Site Audit function exposing file and directory contents

Summary: The Project Site Audit function is vulnerable to XXE when parsing sitemap.xml files. Description: The Site Audit function spiders a given website and performs analysis on the discovered pages. In order to improve website spidering the URL of a sitemap.xml file can be provided. If provide...