Cross site scripting

Authenticated author or higher role Stored Cross-Site Scripting XSS vulnerability in Fatcat Apps Easy Pricing Tables plugin = 3.1.2 at WordPress...

CLSA-2022-1654174467 Fix CVE(s): CVE-2021-33582

SECURITY UPDATE: String hashing algorithm collisions - debian/patches/CVE-2021-33582-pre.patch: gracefully handle lookup on zero-sized tables - debian/patches/CVE-2021-33582-1.patch: replace ad-hoc algorithm with seeded djb2 in strhash - debian/patches/CVE-2021-33582-2.patch: use a seed when...

WordPress plugin Fatcat Apps Easy Pricing Tables 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a set of blogging platforms developed using the PHP language. WordPress plugin is an application plugin. WordPress Fatcat Apps Easy Pricing Tables plugin 3.1.2 and earlier versions contain a cross-site...

CVE-2021-36866 WordPress Easy Pricing Tables plugin <= 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated author or higher role Stored Cross-Site Scripting XSS vulnerability in Fatcat Apps Easy Pricing Tables plugin = 3.1.2 at WordPress...

CVE-2021-36866 WordPress Easy Pricing Tables plugin <= 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated author or higher role Stored Cross-Site Scripting XSS vulnerability in Fatcat Apps Easy Pricing Tables plugin = 3.1.2 at WordPress...

CVE-2021-36866

Summary: CVE-2021-36866 affects the Fatcat Apps Easy Pricing Tables WordPress plugin up to version 3.1.2. The vulnerability is an authenticated Stored Cross-Site Scripting (XSS) flaw caused by insufficient sanitization/escaping of inputs in the plugin, enabling an authenticated user (author or hi...

Easy Pricing Tables < 3.2.1 - Reflected Cross-Site-Scripting

The plugin does not sanitise and escape parameter before outputting it back in a page available to any user both authenticated and unauthenticated when a specific setting is enabled, leading to a Reflected Cross-Site Scripting PoC With the "Compatibility Mode"...

Easy Pricing Tables < 3.1.3 - Author+ Stored Cross-Site Scripting

The plugin does not sanitise and escape some parameters, which could allow users with a role as low as author to perform Stored Cross-Site Scripting attacks...

WordPress Easy Pricing Tables plugin <= 3.1.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress Easy Pricing Tables plugin versions = 3.1.2. Solution Update the WordPress Easy Pricing Tables plugin to the latest available version at least 3.1.3...

GHSA-FCWW-8WVC-38Q9 phpMyAdmin SQL injection vulnerability

In phpMyAdmin 4.x before 4.9.5 and 5.x before 5.0.2, a SQL injection vulnerability was discovered where malicious code could be used to trigger an XSS attack through retrieving and displaying results in tblgetfield.php and libraries/classes/Display/Results.php. The attacker must be able to insert...

GHSA-6P8H-36QP-8H72 Static Info Tables (static_info_tables) extension TYPO3 vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the Static Info Tables staticinfotables extension before 2.3.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Static Info Tables (static_info_tables) extension TYPO3 vulnerable to Cross-site Scripting

Cross-site scripting XSS vulnerability in the Static Info Tables staticinfotables extension before 2.3.1 for TYPO3 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors...

Design/Logic Flaw

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties...

CVE-2022-1726

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties...

CVE-2022-1726

CVE-2022-1726 is a cross-site scripting vulnerability in the Bootstrap Table project when using the Table Export plug-in with exportOptions: htmlContent enabled, in versions prior to 1.20.2. The issue affects the Bootstrap Table code path (wenzhixin/bootstrap-table) and is disclosed as capable of...

CVE-2022-1726

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties...

CVE-2022-1726 Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-table

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties...

CVE-2022-1726 Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in wenzhixin/bootstrap-table

Bootstrap Tables XSS vulnerability with Table Export plug-in when exportOptions: htmlContent is true in GitHub repository wenzhixin/bootstrap-table prior to 1.20.2. Disclosing session cookies, disclosing secure session data, exfiltrating data to third-parties...

GHSA-XC97-R49Q-CXGC phpMyAdmin Local file inclusion through transformation feature

An attacker can exploit phpMyAdmin before 4.8.4 to leak the contents of a local file because of an error in the transformation feature. The attacker must have access to the phpMyAdmin Configuration Storage tables, although these can easily be created in any database to which the attacker has...

GHSA-F9HX-5JQ4-FGJM phpMyAdmin CSRF Vulnerability

phpMyAdmin versions 4.7.x prior to 4.7.6.1/4.7.7 are vulnerable to a CSRF weakness. By deceiving a user to click on a crafted URL, it is possible to perform harmful database operations such as deleting records, dropping/truncating tables etc...