8810 matches found
SPIP information leakage vulnerability
SPIP is a Web-based content publishing system. The system is primarily used for online collaboration. An information disclosure vulnerability exists in SPIP versions prior to 3.1.11 and 3.2.2 prior to 3.2.5, which can be exploited by an attacker to enumerate subscribers...
DEBIAN-CVE-2019-16394
SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...
UBUNTU-CVE-2019-16394
SPIP before 3.1.11 and 3.2 before 3.2.5 provides different error messages from the password-reminder page depending on whether an e-mail address exists, which might help attackers to enumerate subscribers...
CVE-2019-16394
SPIP (website engine) versions affected: 3.1.x prior to 3.1.11 and 3.2.x prior to 3.2.5. The issue is in the password reminder flow, where error messages differ depending on whether the provided e-mail exists, enabling potential user enumeration of subscribers. Root cause: non-homogeneous handlin...
CVE-2019-12517
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The savequizscore functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress...
CVE-2019-12516
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI...
CVE-2019-12516
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI...
Cross site scripting
An XSS issue was discovered in the slickquiz plugin through 1.3.7.1 for WordPress. The savequizscore functionality available via the /wp-admin/admin-ajax.php endpoint allows unauthenticated users to submit quiz solutions/answers, which are stored in the database and later shown in the WordPress...
CVE-2019-12516
The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI...
CVE-2019-12516
The CVE-2019-12516 entry covers a SQL injection vulnerability in the WordPress SlickQuiz plugin up to version 1.3.7.1. Affected component: SlickQuiz WordPress plugin. Root cause: authenticated SQLi via the id parameter in admin pages (/wp-admin/admin.php?page=slickquiz-scores&id=, /slickquiz-edit...
CVE-2019-15867
The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...
CVE-2019-15648
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber...
CVE-2019-15648
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber...
Design/Logic Flaw
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber...
WordPress subscriber plugin cross-site scripting vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. subscriber plugin is a subscription management plugin used in it. A cross-site scripting vulnerability exists in WordPress subscriber...
CVE-2017-18502
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues...
CVE-2017-18502
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues...
Cross site scripting
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues...
CVE-2017-18502
CVE-2017-18502 affects the WordPress subscriber plugin prior to version 1.3.5. The issue is multiple XSS vulnerabilities in the subscriber plugin, enabling an authenticated attacker to execute arbitrary JavaScript in victims’ browsers (potential cookie/credentials risk) as described in connected ...
CVE-2017-18502
The subscriber plugin before 1.3.5 for WordPress has multiple XSS issues...