LimeSurvey 安全漏洞

LimeSurvey PHPSurveyor is an open source online survey program from the LimeSurvey team, which supports survey program development, survey distribution, and data collection. A security vulnerability exists in LimeSurvey prior to 6.5.12+240611 that stems from the presence of a cross-site scripting...

PT-2024-7373 · Cacti +1 · Cacti +1

Name of the Vulnerable Software and Affected Versions: Cacti versions prior to 1.2.28 Description: The issue arises from the improper sanitization of the title parameter when saving external links in links.php, which is then stored in the database and reflected back to the user in index.php,...

CVE-2024-45933

OnlineNewsSite v1.0 is vulnerable to Cross Site Scripting XSS which allows attackers to execute arbitrary code via the Title and summary fields in the /admin/post/edit/ endpoint...

reNgine 2.2.0 Command Injection

Exploit Title: reNgine 2.2.0 - Command Injection Authenticated Date: 2024-09-29 Exploit Author: Caner Tercan Vendor Homepage: https://rengine.wiki/ Software Link: https://github.com/yogeshojha/rengine Version: v2.2.0 Tested on: macOS POC : 1. Login the Rengine Platform 2. Click the Scan Engine 3...

Cross-site Scripting (XSS)

Overview librenms/librenms is a fully featured network monitoring system that provides a wealth of features and device support. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Title field in the "Alert Rules" feature. Details Cross-site scripting or XSS is a...

WordPress Auto Featured Image from Title plugin <= 2.3 - Reflected Cross-Site Scripting vulnerability

Reflected Cross-Site Scripting vulnerability discovered by vgo0 in WordPress Plugin Auto Featured Image from Title versions = 2.3...

PT-2024-7962 · Librenms · Librenms

Name of the Vulnerable Software and Affected Versions: LibreNMS versions prior to 24.9.0 Description: A Stored Cross-Site Scripting XSS vulnerability in the "Alert Rules" feature allows authenticated users to inject arbitrary JavaScript through the "Title" field. This can lead to the execution of...

LibreNMS 跨站脚本漏洞

LibreNMS is an open source network monitoring system based on PHP and MySQL from the LibreNMS community. The system features customizable alerts, auto-discovery of network environments, and automatic updates. A cross-site scripting vulnerability exists in LibreNMS version 24.7.0 and prior version...

WordPress Auto Featured Image from Title Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)

Software Auto Featured Image from Title Type Plugin Vulnerable versions = 2.3 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8786 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 2889e0c9e9d2 Credits vgo0...

WordPress Sight plugin <= 1.1.2 - Missing Authorization to Sensitive Information Exposure in handler_post_title vulnerability

Missing Authorization to Sensitive Information Exposure in handlerposttitle vulnerability discovered by Francesco Carlucci in WordPress Plugin Sight versions = 1.1.2...

PT-2024-39370 · WordPress · The Sight +1

Name of the Vulnerable Software and Affected Versions: The Sight – Professional Image Gallery and Portfolio plugin for WordPress versions up to, and including, 1.1.2 Description: The issue is related to unauthorized access of data due to a missing capability check on the handler post title...

WordPress plugin Sight 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

CGA-W49J-3H2J-723W

Bulletin has no description...

CVE-2024-8942

Vulnerability in Scriptcase version 9.4.019 that consists of a Cross-Site Scripting XSS, due to the lack of input validation, affecting the “idformmsgtitle” parameter, among others. This vulnerability could allow a remote user to send a specially crafted URL to a victim and retrieve their...

CVE-2024-8624

The MDTF – Meta Data and Taxonomies Filter plugin for WordPress is vulnerable to SQL Injection via the 'metakey' attribute of the 'mdfselecttitle' shortcode in all versions up to, and including, 1.3.3.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation...

PT-2024-39327 · Unknown · Scriptcase

Name of the Vulnerable Software and Affected Versions: Scriptcase version 9.4.019 Description: The issue is a Cross-Site Scripting XSS due to the lack of input validation, affecting the id form msg title parameter, among others. This could allow a remote user to send a specially crafted URL to a...

PT-2024-39139 · WordPress · Mdtf

Name of the Vulnerable Software and Affected Versions: MDTF – Meta Data and Taxonomies Filter plugin for WordPress versions up to, and including, 1.3.3.3 Description: The issue is related to SQL Injection via the meta key attribute of the mdf select title shortcode. This is due to insufficient...

WordPress plugin MDTF SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection...

User-Friendly SVN 安全漏洞

User-Friendly SVN USVN is a set of web-based configuration tools for the Subversion codebase from the USVN team. The tool provides features such as creating new projects, managing lists of authorized users, and more. A security vulnerability exists in versions of User-Friendly SVN prior to v1.0.1...

GHSA-28H4-788G-RH42 Craft CMS vulnerable to stored XSS in breadcrumb list and title fields

Summary Multiple Stored XSS can be triggered by the breadcrumb list and title fields with user input. Details 1. In the /admin/categories page, category title isn't sanitized and triggered xss. 2. In the category edit page under the /admin/categories/, category title in breadcrumb list isn't...