181 matches found
CVE-2010-2275
Cross-site scripting XSS vulnerability in dijit/tests/testCommon.js in Dojo Toolkit SDK before 1.4.2 allows remote attackers to inject arbitrary web script or HTML via the theme parameter, as demonstrated by an attack against dijit/tests/form/testButton.html...
CVE-2010-4939
PHP remote file inclusion vulnerability in index.php in MailForm 1.2 allows remote attackers to execute arbitrary PHP code via a URL in the theme parameter...
CVE-2008-2840
Multiple directory traversal vulnerabilities in Exero CMS 1.0.0 and 1.0.1 allow remote attackers to include and execute arbitrary local files via a .. dot dot in the theme parameter to 1 custompage.php, 2 errors/404.php, 3 members/memberslist.php, 4 members/profile.php, 5 news/fullview.php, 6...
CVE-2024-13409
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the posttypeajaxhandler function. This makes it possible for...
PT-2025-2162 · WordPress · Post Grid
Name of the Vulnerable Software and Affected Versions: Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress versions up to, and including, 1.6.10 Description: The issue allows authenticated attackers, with Contributor-level access and...
CVE-2024-13409: Improper Limitation of a Pathname to a Restricted Directory
The Post Grid, Slider & Carousel Ultimate – with Shortcode, Gutenberg Block & Elementor Widget plugin for WordPress is vulnerable to Local File Inclusion in all versions up to, and including, 1.6.10 via the 'theme' parameter of the posttypeajaxhandler function. This makes it possible for...
PT-2025-49122
Name of the Vulnerable Software and Affected Versions Alinto Sogo version 5.12.3 Description Alinto Sogo 5.12.3 is susceptible to Cross Site Scripting XSS attacks. The issue is located in the handling of the theme parameter. Successful exploitation could allow an attacker to inject malicious...
Croogo Code Issues Vulnerabilities
Croogo is a content management system CMS developed on the CakePHP framework. The system provides content type can be customized as Blog, Node, Page, content editing using WYSIWYG editor and other features. Croogo 4.0.7 and earlier versions of the code problem vulnerability , the vulnerability...
CVE-2023-36126
There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0...
PHPJabbers Appointment Scheduler Cross-Site Scripting Vulnerability
PHPJabbers Appointment Scheduler is a Php-based appointment scheduler plugin for planning time and booking meeting schedules from PHPJabbers Serbia. A security vulnerability exists in PHPJabbers Appointment Scheduler version v3.0, which originates from a cross-site scripting XSS vulnerability in...
CVE-2023-36126: Improper Neutralization of Input During Web Page Generation
There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Appointment Scheduler v3.0...
CVE-2023-40755
There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0...
CVE-2023-40755
There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0...
CVE-2023-40755
There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0...
Cross site scripting
There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0...
PHPJabbers Callback Widget Cross-site Scripting Vulnerability
PHPJabbers Callback Widget is a simple PHP script that places a discreet callback button on a website. A security vulnerability exists in PHPJabbers Callback Widget that stems from a cross-site scripting vulnerability in the theme parameter of preview.php...
PT-2023-27620 · Phpjabbers · Phpjabbers Callback Widget
Name of the Vulnerable Software and Affected Versions: PHPJabbers Callback Widget version 1.0 Description: There is a Cross Site Scripting XSS vulnerability in the theme parameter of the "preview.php" file. This issue allows for malicious script execution. Recommendations: For PHPJabbers Callback...
CVE-2023-40755: Improper Neutralization of Input During Web Page Generation
There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0...