CVE-2022-2695

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to images via the media uploader in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2022-2695

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to images via the media uploader in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2022-2695 Beaver Builder – WordPress Page Builder <= 2.5.5.2 - Authenticated Stored Cross-Site Scripting via 'caption'

The Beaver Builder – WordPress Page Builder for WordPress is vulnerable to Stored Cross-Site Scripting via the 'caption' parameter added to images via the media uploader in versions up to, and including, 2.5.5.2 due to insufficient input sanitization and output escaping. This makes it possible fo...

CVE-2022-2695

Beaver Builder – WordPress Page Builder (WordPress) is affected by a Stored XSS in the caption parameter added to images via the media uploader, affecting versions up to and including 2.5.5.2. Root cause: insufficient input sanitization and output escaping. Impact: authenticated attackers with Be...

Beaver Builder < 2.5.5.3 - Authenticated Stored XSS via Caption

The plugin does not sanitise and escape the caption parameter added to images via the media uploader, which could allow users with access to the plugin's editor to perform Cross-Site Scripting attacks...

Emerson Proficy Machine Edition 路径遍历漏洞

Emerson Proficy Machine Edition is an application from Emerson, Inc. an automation solution. A security vulnerability exists in Emerson Proficy Machine Edition versions 9.80 and earlier, which stems from an easy ZipSlip attack via the uploader program, which allows an attacker to plant a maliciou...

CVE-2022-2426

The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators...

CVE-2022-2426

The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators...

CVE-2022-2426

The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators...

Cross site scripting

The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators...

CVE-2022-2426 Thinkific Uploader <= 1.0.0 - Admin+ Stored Cross-Site Scripting

The Thinkific Uploader WordPress plugin through 1.0.0 does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators...

CVE-2022-2426

The CVE-2022-2426 entry concerns the Thinkific Uploader WordPress plugin (versions ≤ 1.0.0). The vulnerability is a Stored Cross-Site Scripting (XSS) issue caused by the plugin not sanitising and escaping its settings, enabling high-privilege users (e.g., administrators) to inject XSS that could ...

PT-2022-16570 · WordPress · Thinkific Uploader

Name of the Vulnerable Software and Affected Versions: Thinkific Uploader WordPress plugin versions 1.0.0 and earlier Description: The issue concerns the lack of sanitization and escaping of settings in the plugin, which could allow high-privilege users, such as administrators, to perform Stored...

WordPress plugin Thinkific Uploader 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

chewb-server (>=0.0.1 <=0.0.20), video-dash-uploader (>=0.0.1 <=0.0.4) +1 more potentially affected by CVE-2020-28436 via google-cloudstorage-commands (=0.0.1)

google-cloudstorage-commands NPM version =0.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on google-cloudstorage-commands and may be impacted: - chewb-server =0.0.1, =0.0.1, =0.0.1, =0.0.2 Source cves: CVE-2020-28436 Source advisory:...

Thinkific Uploader <= 1.0.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators. PoC Put the following payload in any of the settings: "...

WordPress Thinkific Uploader plugin <= 1.0.0 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Raad Haddad in WordPress Thinkific Uploader plugin versions = 1.0.0. Solution Deactivate and delete. This plugin has been closed as of July 15, 2022 and is not available for download. This closure is temporary, pending a fu...

Thinkific Uploader <= 1.0.0 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks against other administrators. Put the following payload in any of the settings: "...

WordPress Kaswara Modern WPBakery Page Builder 3.0.1 File Upload Vulnerability

WordPress Kaswara Modern WPBakery Page Builder plugin versions 3.0.1 and below suffer from an arbitrary file upload vulnerability. Description: Arbitrary File Upload/Deletion and Other Affected Plugin: Kaswara Modern WPBakery Page Builder Addons Plugin Slug: kaswara Affected Versions: = 3.0.1 CVE...

OS Command Injection

s3-uploader is vulnerable to os command injection. The vulnerability exists in the getMetadata function in index.js because the parameters are not properly restricted which allows an attacker to inject and execute arbitrary os commands...