346 matches found
CVE-2025-6540
CVE-2025-6540 relates to the WordPress plugin “web-cam” (versions up to 1.0). It is a Stored Cross-Site Scripting (Stored XSS) vulnerability via the slug parameter caused by insufficient input sanitization and output escaping. Exploitation requires at least Contributor-level authentication, and t...
CVE-2024-30536
Cross-Site Request Forgery CSRF vulnerability in WPFactory Slugs Manager.This issue affects Slugs Manager: from n/a through 2.6.7...
CVE-2023-26515
Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Ko Takagi Simple Slug Translate plugin = 2.7.2 versions...
CVE-2023-44238
Cross-Site Request Forgery CSRF vulnerability in Joakim Ling Remove slug from custom post type plugin = 1.0.3 versions...
CVE-2023-27581
github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0 and prior to version 4.4.1, this action uses the github.headref parameter in an insecure way. This vulnerability can be triggered by any user on...
CVE-2021-4410
The Qtranslate Slug plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.1.18. This is due to missing or incorrect nonce validation on the savepostdata function. This makes it possible for unauthenticated attackers to save post data via a forged...
CVE-2019-17433
z-song laravel-admin 1.7.3 has XSS via the Slug or Name on the Roles screen, because of mishandling on the "Operation log" screen...
CVE-2015-10092
A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress. It has been classified as problematic. Affected is the function addslugmetabox of the file includes/class-qtranslate-slug.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotel...
CVE-2012-6633
Cross-site scripting XSS vulnerability in wp-includes/default-filters.php in WordPress before 3.3.3 allows remote attackers to inject arbitrary web script or HTML via an editable slug field...
Security Bulletin: For IBM Cloudpak for Watson AIOPS 3.5.1
Summary This SB contains a list for all CVE's listed here - CVE-2022-36083, CVE-2022-21123, CVE-2022-21125, CVE-2022-21166, CVE-2021-21797, CVE-2022-35941, CVE-2021-42248, CVE-2021-42836, CVE-2022-40186, CVE-2022-41316, CVE-2021-36090, CVE-2020-29529, CVE-2020-7219 fixed in 3.5.1 Vulnerability...
CVE-2024-9000
In lunary-ai/lunary before version 1.4.26, the checklists.post endpoint allows users to create or modify checklists without validating whether the user has proper permissions. This missing access control permits unauthorized users to create checklists, bypassing intended permission checks...
CVE-2024-9000
In lunary-ai/lunary before version 1.4.26, the checklists.post endpoint allows users to create or modify checklists without validating whether the user has proper permissions. This missing access control permits unauthorized users to create checklists, bypassing intended permission checks...
CVE-2024-9000 Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary
In lunary-ai/lunary before version 1.4.26, the checklists.post endpoint allows users to create or modify checklists without validating whether the user has proper permissions. This missing access control permits unauthorized users to create checklists, bypassing intended permission checks...
CVE-2024-9000 Improper Authorization and Duplicate Slug Vulnerability in lunary-ai/lunary
In lunary-ai/lunary before version 1.4.26, the checklists.post endpoint allows users to create or modify checklists without validating whether the user has proper permissions. This missing access control permits unauthorized users to create checklists, bypassing intended permission checks...
CVE-2025-23640
Cross-Site Request Forgery CSRF vulnerability in Nazmul Ahsan Rename Author Slug rename-author-slug allows Stored XSS.This issue affects Rename Author Slug: from n/a through = 1.2.0...
CVE-2025-0377
An archive extraction vulnerability was found in HashiCorp's go-slug library. When go-slug performs an extraction, the filename/extraction path is taken from the tar entry via the header.Name. It was discovered that the unpacking step improperly validated paths, potentially leading to path...
GO-2025-3413 HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug
HashiCorp go-slug Vulnerable to Zip Slip Attack in github.com/hashicorp/go-slug...
Relative Path Traversal
github.com/hashicorp/go-slug is vulnerable to Relative Path Traversal. The vulnerability is due to improper path validation when extracting user-provided paths from tar entries, allowing for directory traversal and potential overwriting of arbitrary files...
Cross-site Scripting (XSS)
Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through the manipulation of the /admin/auth/roles component due to improper sanitization of the Slug field. An attacker can inject malicious scripts by sending crafted inputs to the affected page. Details...
