WordPress plugin ProfileGrid security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-37374 · Bethesda · Bethesda Online Reservation System

Name of the Vulnerable Software and Affected Versions: Bethesda Online Reservation System version 1.0 Description: A critical issue has been found in the Bethesda Online Reservation System, affecting the uploadImage function of the file /admin/mod room/controller.php?action=add. The manipulation ...

CVE-2024-3369

A vulnerability, which was classified as critical, has been found in code-projects Car Rental 1.0. Affected by this issue is some unknown functionality of the file add-vehicle.php. The manipulation of the argument Upload Image leads to unrestricted upload. The attack may be launched remotely. The...

Simple Car Rental System 代码问题漏洞

Simple Car Rental System is a simple car rental application. A code issue vulnerability exists in version 1.0 of Simple Car Rental System due to a file upload vulnerability in the parameter Upload Image of the file add-vehicle.php...

PT-2024-25445 · Unknown · Code-Projects Car Rental

Name of the Vulnerable Software and Affected Versions: code-projects Car Rental version 1.0 Description: A critical issue has been found in the code-projects Car Rental software. The problem affects some unknown functionality of the file add-vehicle.php. The manipulation of the Upload Image...

BIT-MEDIAWIKI-2021-44855

An issue was discovered in MediaWiki before 1.35.5, 1.36.x before 1.36.3, and 1.37.x before 1.37.1. There is Blind Stored XSS via a URL to the Upload Image feature...

BIT-ESPOCRM-2023-46736

EspoCRM is an Open Source CRM Customer Relationship Management software. In affected versions there is Server-Side Request Forgery SSRF vulnerability via the upload image from url api. Users who have access to the /Attachment/fromImageUrl endpoint can specify URL to point to an internal host. Eve...

CVE-2023-46736 Server-Side Request Forgery in espocrm

EspoCRM is an Open Source CRM Customer Relationship Management software. In affected versions there is Server-Side Request Forgery SSRF vulnerability via the upload image from url api. Users who have access to the /Attachment/fromImageUrl endpoint can specify URL to point to an internal host. Eve...

CVE-2023-46736: Server-Side Request Forgery (SSRF)

EspoCRM is an Open Source CRM Customer Relationship Management software. In affected versions there is Server-Side Request Forgery SSRF vulnerability via the upload image from url api. Users who have access to the /Attachment/fromImageUrl endpoint can specify URL to point to an internal host. Eve...

PT-2023-6275 · Unknown · Reciply Plugin

Name of the Vulnerable Software and Affected Versions: reciply Plugin versions 1.1.7 and earlier Description: A critical issue affects the processing of the file uploadImage.php, leading to unrestricted upload. The attack may be initiated remotely, potentially allowing an attacker to execute...

ASUS RT-AX88U 跨站脚本漏洞

The ASUS RT-AX88U is a wireless router from Asus China. The ASUS RT-AX88U suffers from a cross-site scripting vulnerability that stems from the lack of effective filtering and escaping of user-supplied data by the Custom User Icons feature, which can be exploited by an attacker to perform a store...

CVE-2023-1169: Missing Authorization

The OoohBoi Steroids for Elementor plugin for WordPress is vulnerable to missing authorization due to a missing capability check on the 'fileuploadercallback' function in versions up to, and including, 2.1.4. This makes it possible for subscriber-level attackers to upload image attachments to the...

Cross-site Scripting (XSS)

opencms-gwt is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the generateTooltipHtml function of CmsResultItemWidget.java, which allows an attacker to inject and execute malicious javascript or HTML through the Title field under the upload image module...

GLSA-202305-24 : MediaWiki: Multiple Vulnerabilities

The remote host is affected by the vulnerability described in GLSA-202305-24 MediaWiki: Multiple Vulnerabilities - MediaWiki before 1.36.2 allows XSS. Month related MediaWiki messages are not escaped before being used on the Special:Search results page. CVE-2021-41798 - MediaWiki before 1.36.2...

GHSA-M44F-9JHG-59CR alkacon-OpenCMS vulnerable to stored Cross-site Scripting

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

alkacon-OpenCMS vulnerable to stored Cross-site Scripting

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

CVE-2023-31544

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

Cross site scripting

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

CVE-2023-31544: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in alkacon-OpenCMS v11.0.0.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module...

PT-2023-23381 · Alkacon · Alkacon Opencms

Name of the Vulnerable Software and Affected Versions: alkacon-OpenCMS version 11.0.0.0 Description: A stored cross-site scripting XSS issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Title field under the Upload Image module. This enables...