206 matches found
Information Disclosure
johnpbloch/wordpress-core is vulnerable to information disclosure. The vulnerability exists in the getcommentexcerpt function in comment-template.php because the comments from password-protected non-public posts and pages are not restricted from viewing under certain conditions...
CVE-2020-25286: Undefined Security Weakness
In wp-includes/comment-template.php in WordPress before 5.4.2, comments from a post or page could sometimes be seen in the latest comments even if the post or page was not public...
CVE-2020-12639
phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...
Cross site scripting
phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...
CVE-2020-12639
phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...
CVE-2020-12639: Improper Neutralization of Input During Web Page Generation
phpList before 3.5.3 allows XSS, with resultant privilege elevation, via lists/admin/template.php...
CVE-2020-10578
An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1...
CVE-2020-10578: Undefined Security Weakness
An arbitrary file read vulnerability exists in system/controller/backend/template.php in QCMS v3.0.1...
CVE-2020-10495
CSRF in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to edit an article template, given the id, via a crafted request...
CVE-2020-10409
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-template.php by adding a question mark ? followed by the payload...
CVE-2020-10398
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/add-template.php by adding a question mark ? followed by the payload...
Cross site scripting
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/add-template.php by adding a question mark ? followed by the payload...
Cross site scripting
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-template.php by adding a question mark ? followed by the payload...
Cross site request forgery (csrf)
CSRF in admin/add-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new article template via a crafted request...
CVE-2020-10495
CVE-2020-10495 is a CSRF vulnerability affecting Chadha PHPKB Standard Multi-Language 9. Assaults can edit an article template via crafted requests to admin/edit-template.php (requires id). Root cause is a CSRF weakness in the web application’s handling of template edits. The NVD entry lists a CV...
CVE-2020-10482
CSRF in admin/add-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new article template via a crafted request...
CVE-2020-10482
The connected documents confirm CVE-2020-10482 affects Chadha PHPKB Standard Multi-Language version 9, via a CSRF weakness in admin/add-template.php that lets an attacker add a new article template with a crafted request. The vulnerability stems from insufficient CSRF protection in that endpoint....
CVE-2020-10463: Improper Neutralization of Input During Web Page Generation
Reflected XSS in admin/edit-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to inject arbitrary web script or HTML via the GET parameter p...
CVE-2020-10482: Cross-Site Request Forgery (CSRF)
CSRF in admin/add-template.php in Chadha PHPKB Standard Multi-Language 9 allows attackers to add a new article template via a crafted request...
CVE-2020-10409: Improper Neutralization of Input During Web Page Generation
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/edit-template.php by adding a question mark ? followed by the payload...