940 matches found
Colorful Categories < 2.0.15 - Arbitrary Colors Update via CSRF
The plugin does not enforce nonce checks which could allow attackers to make a logged in admin or editor change taxonomy colors via a CSRF attack PoC...
Description of the security update for SharePoint Enterprise Server 2016: October 12, 2021 (KB5002029)
None None...
DRUPAL-CONTRIB-2021-031
The module provides a field widget for selecting taxonomy terms in a hierarchical fashion. The module doesn't sanitize user input in certain cases, leading to a possible Cross-Site-Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with...
Client-side Hierarchical Select - Moderately critical - Cross-site scripting - SA-CONTRIB-2021-031
The module provides a field widget for selecting taxonomy terms in a hierarchical fashion. The module doesn't sanitize user input in certain cases, leading to a possible Cross-Site-Scripting XSS vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with...
Taxonomy Manager - Moderately critical - Access bypass - SA-CONTRIB-2021-035
This module provides a powerful interface for managing a taxonomy vocabulary. A vocabulary gets displayed in a dynamic tree view, where parent terms can be expanded to list their nested child terms or can be collapsed. The module does not take the correct user permissions into account, allowing a...
BetterDocs < 1.9.0 - Reflected Cross-Site Scripting
The plugin does not escape the tagID before outputting it back in the edit category page of the admin dashboard, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/term.php?taxonomy=doccategory&tagID=147"alert/XSS/...
Description of the security update for SharePoint Enterprise Server 2016: September 14, 2021 (KB5002020)
None None...
PostX Gutenberg Blocks for Post Grid < 2.4.10 - Contributor+ Stored Cross-Site Scripting
The plugin allows users with a role as low as Contributor to perform Stored Cross-Site Scripting attacks via the plugin's block. PoC can be entered with code editor the example below uses Taxonomy block; all blocks are vulnerable:...
CVE-2021-24444
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfilteredhtml capability is disallowed, leading to an authenticated Store...
CVE-2021-24444
The TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin before 3.0.7.2 does not sanitise its Taxonomy description field, allowing high privilege users to set JavaScript payload in them even when the unfilteredhtml capability is disallowed, leading to an authenticated Store...
PT-2021-15972 · WordPress · Taxopress
Name of the Vulnerable Software and Affected Versions: TaxoPress – Create and Manage Taxonomies, Tags, Categories WordPress plugin versions prior to 3.0.7.2 Description: The issue allows high privilege users to set JavaScript payload in the Taxonomy description field, leading to an authenticated...
WordPress Plugins TaxoPress 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
GHSA-JFVF-RFMQ-QWF8 Croos-site scripting in Croogo
Croogo before 3.0.7 allows XSS via the title to admin/menus/menus or admin/taxonomy/vocabularies...
Description of the security update for SharePoint Enterprise Server 2016: June 8, 2021 (KB5001922)
None None...
Select All Categories and Taxonomies < 1.3.2 - Reflected Cross-Site Scripting (XSS)
The settings page of the plugin did not properly sanitise the tab parameter before outputting it back, leading to a reflected Cross-Site Scripting issue https://example.com/wp-admin/options-general.php?page=moove-taxonomy-settings&tab=" onMouseOver="alert1;...
Description of the security update for SharePoint Enterprise Server 2016: April 13, 2021 (KB4504723)
None None...
Description of the security update for SharePoint Enterprise Server 2016: September 8, 2020
None None...
Services - Moderately critical - Access bypass - SA-CONTRIB-2020-022
This module provides a standardized solution for building API's so that external clients can communicate with Drupal. The module's taxonomy term index resource doesn't take into consideration certain access control tags provided but unused by core, that certain contrib modules depend on. This...
Cross-site Scripting (XSS)
Croogo is vulnerable to cross-site scripting XSS. The attacker can inject malicious script in the title parameter of admin/menus/menus or admin/taxonomy/vocabularies, causing the malicious script to be executed when a user visits the page...
