CVE Search Engine - Security Vulnerabilities and Exploits Search Tool

show all

60 matches found

Positive Technologies•added 2021/08/30 12:00 a.m.•7 views

PT-2021-16107

Name of the Vulnerable Software and Affected Versions Sitewide Notice WP WordPress plugin versions prior to 2.3 Description The issue allows high privilege users to perform Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, due to the plugin not sanitizing some ...

4.8CVSS0.00617EPSS

SaveExploits2References5

Rapid7 Vulnerability Database (full)•added 2021/08/30 12:00 a.m.•13 views

CVE-2021-24592: Improper Neutralization of Input During Web Page Generation

The Sitewide Notice WP WordPress plugin before 2.3 does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

4.8CVSS5.8AI score0.00617EPSS

SaveExploits2References3

Veracode•added 2021/08/22 2:25 a.m.•35 views

Authorization Bypass

mediawiki is vulnerable to authorization bypass. When a bot account has a sitewide block applied, it is to purge pages through the MediaWiki Action API which a "sitewide block" should have prevented...

7.5CVSS3.7AI score0.01943EPSS

SaveExploits1References14Affected Software2

WPVulnDB•added 2021/08/02 12:00 a.m.•22 views

Sitewide Notice WP < 2.3 - Authenticated Stored XSS

The plugin does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the Message setting of the plugin: The XSS will ...

4.8CVSS1.4AI score0.00617EPSS

SaveExploits2Affected Software1

Patchstack•added 2021/08/02 12:00 a.m.•28 views

WordPress Sitewide Notice WP <= 2.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Sitewide Notice WP versions = 2.2. Solution Update the WordPress Sitewide Notice WP to the latest available version at least 2.3...

4.8CVSS2.1AI score0.00617EPSS

SaveExploits2References3Affected Software1

osv_mgasa•added 2021/07/12 8:26 p.m.•26 views

MGASA-2021-0346 Updated mediawiki packages fix a security vulnerability

In MediaWiki before 1.31.15, 1.32.x through 1.35.x before 1.35.3, and 1.36.x before 1.36.1, bots have certain unintended API access. When a bot account has a "sitewide block" applied, it is able to still "purge" pages through the MediaWiki Action API which a "sitewide block" should have prevented...

7.5CVSS7.6AI score0.01943EPSS

SaveExploits1References4

RedhatCVE•added 2021/07/08 10:51 a.m.•64 views

CVE-2021-35197

An improper authorization vulnerability was found in mediawiki. Mediawiki bots may have unintended API access even when a sitewide block has been applied. An attacker can use this vulnerability to potentially utilize a bot to access the mediawiki API and conduct actions like purge pages...

7.5CVSS4AI score0.01943EPSS

SaveExploits1References3

NVD•added 2021/07/02 1:15 p.m.•24 views

CVE-2021-35197

7.5CVSS0.01943EPSS

SaveExploits1References8

osv_debian•added 2021/07/02 1:15 p.m.•5 views

DEBIAN-CVE-2021-35197

7.5CVSS6.4AI score0.01943EPSS

SaveExploits1References1

osv_cve•added 2021/07/02 1:15 p.m.•32 views

CVE-2021-35197

7.5CVSS6.6AI score

SaveExploits0References8

osv_ubuntu•added 2021/07/02 1:15 p.m.•15 views

UBUNTU-CVE-2021-35197

7.5CVSS6.8AI score0.01943EPSS

SaveExploits1References4

attackerkb•added 2021/07/02 1:15 p.m.•12 views

CVE-2021-35197

7.5CVSS6.8AI score0.01943EPSS

SaveExploits1References13

Prion•added 2021/07/02 1:15 p.m.•33 views

Code injection

5CVSS7.3AI score0.01943EPSS

SaveExploits1References8Affected Software3

UbuntuCve•added 2021/07/02 1:15 p.m.•49 views

CVE-2021-35197

7.5CVSS6.8AI score0.01943EPSS

SaveExploits1References3

CVE•added 2021/07/02 12:28 p.m.•157 views

CVE-2021-35197

MediaWiki CVE-2021-35197 affects multiple branches (before 1.31.15, 1.32.x–1.35.x before 1.35.3, and 1.36.x before 1.36.1). Root cause: bots with a sitewide block could still purge pages via the Action API, despite the block. Impact: unintended API access leading to page purges; exploitation deta...

7.5CVSS7.3AI score0.01943EPSS

SaveExploits1References8Affected Software1

Cvelist•added 2021/07/02 12:28 p.m.•57 views

CVE-2021-35197

7.7AI score0.01943EPSS

SaveExploits1References8

Mend•added 2021/07/02 12:28 p.m.•6 views

CVE-2021-35197

8.7CVSS0.01943EPSS

SaveExploits1References15

Rapid7 Vulnerability Database (full)•added 2021/07/02 12:00 a.m.•6 views

CVE-2021-35197: Incorrect Authorization

7.5CVSS5.8AI score0.01943EPSS

SaveExploits1References2

Positive Technologies•added 2021/06/27 12:00 a.m.•12 views

PT-2021-6527 · Mediawiki +1 · Mediawiki +1

Name of the Vulnerable Software and Affected Versions: MediaWiki versions 1.31.15 and earlier MediaWiki versions 1.32.x through 1.35.x before 1.35.3 MediaWiki versions 1.36.x before 1.36.1 Description: The issue concerns unintended API access for bots in MediaWiki. When a bot account has a...

9.8CVSS6.4AI score0.03906EPSS

SaveExploits19References107

CNVD•added 2017/09/10 12:00 a.m.•12 views

Stored Cross-Site Scripting Vulnerability in PigCMS Sitewide

PigCms also known as Piggy CMS is a multi-user php + mysql based WeChat marketing source code program developed by Hefei Pisan Internet Information Technology Co. PigCMS has a stored cross-site scripting vulnerability throughout the site. After logging into the system, an attacker inserts malicio...

6.3AI score

SaveExploits0

Rows per page

Query Builder

Family

Bulletin Type

Min CVSS Score

Date

Order by