PT-2023-20694 · Unknown · Ko Takagi Simple Slug Translate

Name of the Vulnerable Software and Affected Versions: Ko Takagi Simple Slug Translate plugin versions prior to 2.7.3 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. Recommendations: For versions prior to...

WordPress plugin Simple Slug Translate 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2023-27581 github-slug-action vulnerable to arbitrary code execution

github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0 and prior to version 4.4.1, this action uses the github.headref parameter in an insecure way. This vulnerability can be triggered by any user on...

CVE-2023-27581 github-slug-action vulnerable to arbitrary code execution

github-slug-action is a GitHub Action to expose slug value of GitHub environment variables inside of one's GitHub workflow. Starting in version 4.0.0 and prior to version 4.4.1, this action uses the github.headref parameter in an insecure way. This vulnerability can be triggered by any user on...

PT-2023-21224 · Github · Github-Slug-Action

Name of the Vulnerable Software and Affected Versions: github-slug-action versions 4.0.0 through 4.4.1 Description: The github-slug-action uses the github.head ref parameter in an insecure way, allowing any user on GitHub to trigger the vulnerability by creating a pull request with a branch name...

GitHub Slug action 命令注入漏洞

GitHub Slug action is a tool for exposing the slug values of GitHub environment variables in GitHub workflows. A command injection vulnerability exists in GitHub Slug action version 4.0.0 through versions prior to 4.4.1. An attacker could use this vulnerability to execute code on the GitHub runne...

CVE-2015-10092

A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress. It has been classified as problematic. Affected is the function addslugmetabox of the file includes/class-qtranslate-slug.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotel...

Cross site scripting

A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress. It has been classified as problematic. Affected is the function addslugmetabox of the file includes/class-qtranslate-slug.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotel...

CVE-2015-10092

The CVE concerns the Qtranslate Slug Plugin for WordPress (up to version 1.1.16). The vulnerability affects the add_slug_meta_box function in includes/class-qtranslate-slug.php and can be triggered remotely to perform cross-site scripting. A fix is available in version 1.1.17, with patch 74b39326...

CVE-2015-10092 Qtranslate Slug Plugin class-qtranslate-slug.php add_slug_meta_box cross site scripting

A vulnerability was found in Qtranslate Slug Plugin up to 1.1.16 on WordPress. It has been classified as problematic. Affected is the function addslugmetabox of the file includes/class-qtranslate-slug.php. The manipulation leads to cross site scripting. It is possible to launch the attack remotel...

WordPress plugin Qtranslate Slug 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

PT-2023-10271 · WordPress · Qtranslate Slug Plugin

Name of the Vulnerable Software and Affected Versions: Qtranslate Slug Plugin versions up to 1.1.16 Description: A vulnerability was found in the Qtranslate Slug Plugin, which has been classified as problematic. The issue affects the add slug meta box function of the file...

WordPress Simple Slug Translate Plugin <= 2.7.2 is vulnerable to Cross Site Scripting (XSS)

Software Simple Slug Translate Type Plugin Vulnerable versions = 2.7.2 Fixed in 2.7.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-26515 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a353ffb7160f Credits yuyudhn Required...

SUSE CVE-2015-5144

Django before 1.4.21, 1.5.x through 1.6.x, 1.7.x before 1.7.9, and 1.8.x before 1.8.3 uses an incorrect regular expression, which allows remote attackers to inject arbitrary headers and conduct HTTP response splitting attacks via a newline character in an 1 email message to the EmailValidator, a ...

GHSA-2G5J-5X95-R6HR Unsafe tar unpacking in HashiCorp go-slug

HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks...

Unsafe tar unpacking in HashiCorp go-slug

HashiCorp go-slug before 0.5.0 does not address attempts at directory traversal involving ../ and symlinks...

Cross site request forgery (csrf)

The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know...

CVE-2022-4102 Royal Elementor Addons < 1.3.56 - Subscriber+ Arbitrary Post Deletion

The Royal Elementor Addons WordPress plugin before 1.3.56 does not have authorization and CSRF checks when deleting a template and does not ensure that the post to be deleted is a template. This could allow any authenticated users, such as subscribers, to delete arbitrary posts assuming they know...

Eventify <= 2.1 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to Settings » Eventify. 2. Under 'Category...

CVE-2022-3747

The Becustom plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0.5.2. This is due to missing nonce validation when saving the plugin's settings. This makes it possible for unauthenticated attackers to update the plugin's settings like...