5240 matches found
CVE-2022-25091
Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature...
CVE-2022-25091: Incorrect Authorization
Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature...
CVE-2022-25091
The CVE-2022-25091 entry concerns Infopop Ultimate Bulletin Board up to version 5.47a. The vulnerability allows unauthenticated users to disclose all messages posted inside private forums via the quote reply feature. The issue is a confidentiality impact (C:L) with no integrity or availability im...
PT-2023-12779 · Infopop · Infopop Ultimate Bulletin Board
Name of the Vulnerable Software and Affected Versions: Infopop Ultimate Bulletin Board versions up to 5.47a Description: The issue allows all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature. Recommendations: For Infopop Ultimate Bulletin...
CVE-2022-25091
Infopop Ultimate Bulletin Board up to v5.47a was discovered to allow all messages posted inside private forums to be disclosed by unauthenticated users via the quote reply feature...
Infopop Ultimate Bulletin Board Security Vulnerabilities
Infopop Ultimate Bulletin Board is a web forum system from Infopop, Inc. A security vulnerability exists in Infopop Ultimate Bulletin Board version 5.47a and prior versions, which originated from a vulnerability that allows unauthenticated users to view messages in private forums by referring to...
WordPress NEX-Forms – Ultimate Form Builder Plugin < 8.4 is vulnerable to SQL Injection
Software NEX-Forms – Ultimate Form Builder Type Plugin Vulnerable versions 8.4 Fixed in 8.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-2114 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 633a726244b6 Credits Alexander Schmid Required privilege...
WordPress Ultimate Carousel For Elementor Plugin <= 2.1.7 is vulnerable to Cross Site Scripting (XSS)
Software Ultimate Carousel For Elementor Type Plugin Vulnerable versions = 2.1.7 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0280 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 5d4b9d7e6fcb Credits István...
WordPress Ultimate Carousel For WPBakery Page Builder Plugin <= 2.6 is vulnerable to Cross Site Scripting (XSS)
Software Ultimate Carousel For WPBakery Page Builder Type Plugin Vulnerable versions = 2.6 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0267 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 8fe712db2127...
WordPress Ultimate Addons for Contact Form 7 Plugin <= 3.1.23 is vulnerable to SQL Injection
Software Ultimate Addons for Contact Form 7 Type Plugin Vulnerable versions = 3.1.23 Fixed in 3.1.24 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-30495 Patch priority High CVSS severity High 8.5 Developer Themefic PSID 0d0db778fa81 Credits Ivy TOOR, LISA Required privilege...
CVE-2023-23832
Auth. contributor+ Cross-Site Scripting XSS vulnerability in TC Ultimate WP Query Search Filter plugin = 1.0.10 versions...
CVE-2023-23832 WordPress Ultimate WP Query Search Filter Plugin <= 1.0.10 is vulnerable to Cross Site Scripting (XSS)
Auth. contributor+ Cross-Site Scripting XSS vulnerability in TC Ultimate WP Query Search Filter plugin = 1.0.10 versions...
CVE-2023-23832
CVE-2023-23832: A Cross-Site Scripting (XSS) vulnerability in the WordPress plugin TC Ultimate WP Query Search Filter affects versions
CVE-2023-23832: Improper Neutralization of Input During Web Page Generation
Auth. contributor+ Cross-Site Scripting XSS vulnerability in TC Ultimate WP Query Search Filter plugin = 1.0.10 versions...
WordPress plugin "Ultimate WP Query Search Filter" – Cross-site scripting vulnerabilities
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
Ultimate Carousel For WPBakery Page Builder <= 2.6 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. The plugin author was made aware of this...
CVE-2023-30474
Cross-Site Request Forgery CSRF vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin = 1.3 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Kilian Evang Ultimate Noindex Nofollow Tool II plugin = 1.3 versions...