CVE-2024-24712

The CVE-2024-24712 entry concerns the WordPress plugin Heateor Social Login (Heateor Social Login WordPress) with a Stored XSS issue caused by improper neutralization of input during web page generation. Affected versions are up to 1.1.30; a fixed release is 1.1.31. Public sources (Patchstack, Re...

GHSA-Q25H-JCH8-GFRP Concrete CMS vulnerable to stored XSS via the Role Name field

Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the...

CVE-2024-1246

Concrete CMS in version 9 before 9.2.5 is vulnerable to reflected XSS via the Image URL Import Feature due to insufficient validation of administrator provided data. A rogue administrator could inject malicious code when importing images, leading to the execution of the malicious code on the...

Input validation

Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the...

CVE-2024-1247 Concrete CMS version 9 before 9.2.5 vulnerable to stored XSS via the Role Name field

Concrete CMS version 9 before 9.2.5 is vulnerable to stored XSS via the Role Name field since there is insufficient validation of administrator provided data for that field. A rogue administrator could inject malicious code into the Role Name field which might be executed when users visit the...

GHSA-C85R-FWC7-45VC Rancher permissions on 'namespaces' in any API group grants 'edit' permissions on namespaces in 'core'

Impact A vulnerability has been identified when granting a create or global role for a resource type of "namespaces"; no matter the API group, the subject will receive permissions for core namespaces. This can lead to someone being capable of accessing, creating, updating, or deleting a namespace...

CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature

Affected packages The vulnerability has been discovered in the samples that use the preview feature: samples/old//.html plugins/plugin name/samples//.html All integrators that use these samples in the production code can be affected. Impact A potential vulnerability has been discovered in one of...

GHSA-MW2C-VX6J-MG76 CKEditor4 Cross-site Scripting vulnerability in samples with enabled the preview feature

Affected packages The vulnerability has been discovered in the samples that use the preview feature: samples/old//.html plugins/plugin name/samples//.html All integrators that use these samples in the production code can be affected. Impact A potential vulnerability has been discovered in one of...

CVE-2023-51514

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Codeboxr Team CBX Bookmark & Favorite allows Stored XSS.This issue affects CBX Bookmark & Favorite: from n/a through 1.7.13...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Codeboxr Team CBX Bookmark & Favorite allows Stored XSS.This issue affects CBX Bookmark & Favorite: from n/a through 1.7.13...

CVE-2023-51514

CVE-2023-51514 is a Stored XSS in the CBX Bookmark & Favorite WordPress plugin (cbxwpbookmark) affecting versions up to 1.7.13. Root cause: Improper neutralization of input during web page generation. Impact: stored script execution on affected sites. Remediation: patch available (Patched) in lat...

CVE-2023-51691

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gVectors Team Comments – wpDiscuz allows Stored XSS.This issue affects Comments – wpDiscuz: from n/a through 7.6.12...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gVectors Team Comments – wpDiscuz allows Stored XSS.This issue affects Comments – wpDiscuz: from n/a through 7.6.12...

CVE-2023-51691 WordPress wpDiscuz Plugin <= 7.6.12 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in gVectors Team Comments – wpDiscuz allows Stored XSS.This issue affects Comments – wpDiscuz: from n/a through 7.6.12...

CVE-2023-51691

CVE-2023-51691 concerns the WordPress plugin wpDiscuz, where versions n/a through 7.6.12 are affected by a Stored Cross-Site Scripting (XSS) vulnerability due to improper neutralization of input during web page generation. The root cause is input not being properly sanitized, enabling an attacker...

PT-2024-14460 · Unknown · Live Composer Team Page Builder

Name of the Vulnerable Software and Affected Versions: Live Composer Team Page Builder versions 1.5.23 and earlier Description: The issue is related to improper neutralization of input during web page generation, which allows stored cross-site scripting XSS. This means that an attacker can inject...

PurpleKeep - Providing Azure Pipelines To Create An Infrastructure And Run Atomic Tests

With the rapidly increasing variety of attack techniques and a simultaneous rise in the number of detection rules offered by EDRs Endpoint Detection and Response and custom-created ones, the need for constant functional testing of detection rules has become evident. However, manually re-running...

Code injection

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in InstaWP Team InstaWP Connect – 1-click WP Staging & Migration.This issue affects InstaWP Connect – 1-click WP Staging & Migration: from n/a through 0.1.0.9...

CVE-2024-23506

CVE-2024-23506 affects the InstaWP Connect – 1-click WP Staging & Migration WordPress plugin, specifically versions 0.1.0.9 and earlier. The issue is Exposure of Sensitive Information to an Unauthorized Actor (information disclosure). Public documentation consistently ties the vulnerability to In...

CVE-2024-21630

CVE-2024-21630 (Zulip) describes a flaw in Zulip 8.0 where non-admins can invite users and create multi‑use invitations, while only admins can invite users to streams. The vulnerability is limited to streams the inviter can already see and is not an arbitrary- stream invite. Version 8.1 fixes the...