EUVD-2021-11117

Malware in sbrugna...

agora 跨站脚本漏洞

agora is a cloud-based learning and research platform open-sourced by the Agora Foundation. A cross-site scripting vulnerability exists in versions prior to agora fall23-Alpha1 b087490, which stems from the tag parameter in editorManager.js being susceptible to cross-site scripting attacks...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through crafted requests. An attacker can execute arbitrary scripts in the context of a user's browser by submitting crafted input to the title, categoryTitle, or tmpTag parameters. Details Cross-site scripting ...

Cross-site Scripting (XSS)

Overview Affected versions of this package are vulnerable to Cross-site Scripting XSS through crafted requests. An attacker can execute arbitrary scripts in the context of a user's browser by submitting crafted input to the title, categoryTitle, or tmpTag parameters. Details Cross-site scripting ...

Mist 代码注入漏洞

Mist is an open source multi-cloud management platform from Mist, Inc. in the United States. A code injection vulnerability exists in Mist 4.7.1 and earlier versions, which originates from a cross-site scripting attack on the parameter tag in the file src/mist/api/tag/views.py...

CVE-2024-1396

The Shortcodes and extra features for Phlox theme plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titletag’ parameter in all versions up to, and including, 2.15.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

CVE-2024-9449

The Auto iFrame plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'tag' parameter in all versions up to, and including, 1.7 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, t...

CVE-2022-1281

The Photo Gallery WordPress plugin through 1.6.3 does not properly escape the $POST'filtertag' parameter, which is appended to an SQL query, making SQL Injection attacks possible...

CVE-2021-24203

In the Elementor Website Builder WordPress plugin before 3.1.4, the divider widget includes/widgets/divider.php accepts an ‘htmltag’ parameter. Although the element control lists a fixed set of possible html tags, it is possible for a user with Contributor or above permissions to send a modified...

CVE-2020-36492

DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting XSS vulnerabilities in the component selectmedia.php via the activepath, keyword, tag, fmdo=x, CKEditor and CKEditorFuncNum parameters...

CVE-2020-36491

DedeCMS v7.5 SP2 was discovered to contain multiple cross-site scripting XSS vulnerabilities in the component tagsmain.php via the activepath, keyword, tag, fmdo=x, CKEditor and CKEditorFuncNum parameters...

CVE-2020-35373

In Fiyo CMS 2.0.6.1, the 'tag' parameter results in an unauthenticated XSS attack...

Personal Management System 安全漏洞

Personal Management System is a web application for managing personal data by Dariusz Personal Developer. A security vulnerability exists in Personal Management System v1.4.65, which stems from the injection of a specially crafted payload into the tag parameter in the Image Upload section, which...

CVE-2024-13732

The Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘sectiontag’ parameter in all versions up to, and including, 1.9.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated...

WordPress Responsive Blocks plugin <= 1.9.9 - Authenticated (Contributor+) Stored Cross-Site Scripting via section_tag Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via sectiontag Parameter vulnerability discovered by zaim in WordPress Plugin Responsive Blocks versions = 1.9.9...

PT-2025-2260 · WordPress · Responsive Blocks

Name of the Vulnerable Software and Affected Versions: Responsive Blocks – WordPress Gutenberg Blocks plugin for WordPress versions up to, and including, 1.9.9 Description: The issue is related to Stored Cross-Site Scripting via the section tag parameter due to insufficient input sanitization and...

PT-2025-3856 · WordPress · Jetengine

Name of the Vulnerable Software and Affected Versions: JetEngine plugin for WordPress versions up to, and including, 3.6.2 Description: The issue is related to Stored Cross-Site Scripting due to insufficient input sanitization and output escaping. This allows authenticated attackers with...

WordPress Jet Engine plugin <= 3.6.2 - Authenticated (Contributor+) Stored Cross-Site Scripting via list_tag Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via listtag Parameter vulnerability discovered by stealthcopter in WordPress Plugin JetEngine versions = 3.6.2...

WordPress Orbit Fox by ThemeIsle plugin <= 2.10.43 - Authenticated (Contributor+) Stored Cross-Site Scripting via title_tag Parameter vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via titletag Parameter vulnerability discovered by Ankit Patel in WordPress Plugin Orbit Fox by ThemeIsle versions = 2.10.43...

emlog 代码注入漏洞

emlog is emlog personal developer of a PHP and MySQL based CMS site building system. Code injection vulnerability exists in emlog 2.4.1 and previous versions, the vulnerability stems from the manipulation of the keyword parameter in the /admin/tag.php file leading to cross-site scripting attacks...