WordPress Site Favicon Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS)

Software Site Favicon Type Plugin Vulnerable versions = 0.2 Fixed in 0.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-35642 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 793a8085c766 Credits Cronus Required privilege Administrator...

PT-2024-23761 · Unknown · Broken Images

Name of the Vulnerable Software and Affected Versions: Broken Images versions 0.2 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability that allows Cross-Site Scripting XSS in Broken Images. This means an attacker can trick a user into performing unintended actions...

WordPress Broken Images plugin <= 0.2 - CSRF to XSS vulnerability

CSRF to XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Broken Images versions = 0.2...

ferris-says has undefined behavior when not using UTF-8

Affected versions receive a &u8 from the caller through a safe API, and pass it directly to the unsafe str::fromutf8unchecked function. The behavior of ferrissays::say is undefined if the bytes from the caller don't happen to be valid UTF-8. The flaw was corrected in ferris-says21 by using the sa...

LogoBee Cross-Site Scripting Vulnerability

LogoBee is a logo creation software from LogoBee Inc. in the United States. A cross-site scripting vulnerability exists in LogoBee version 0.2, which stems from the use of a special load that can lead to cross-site scripting...

PT-2023-31944 · Logobee · Logobee

Name of the Vulnerable Software and Affected Versions: LogoBee version 0.2 Description: The issue allows for XSS in the updates.php?id= endpoint. Recommendations: For LogoBee version 0.2, as a temporary workaround, consider restricting access to the "updates.php?id=" endpoint until a patch is...

PT-2023-30716 · Unknown · Websiteguide

Name of the Vulnerable Software and Affected Versions: WebsiteGuide version 0.2 Description: An issue with insecure permissions in WebsiteGuide allows a remote attacker to gain escalated privileges by using a crafted JSON web token jwt. Recommendations: For WebsiteGuide version 0.2, consider...

CVE-2023-37656

WebsiteGuide v0.2 is vulnerable to Remote Command Execution RCE via image upload...

CVE-2022-45361

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Boris Kuzmanov 0mk Shortener plugin = 0.2 versions...

WordPress Plugin 0mk Shortener 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

CVE-2023-25795

Auth. admin+ Cross-Site Scripting XSS vulnerability in WP-master.Ir Feed Changer & Remover plugin = 0.2 versions...

WordPress Plugin master.Ir Feed Changer & Remover 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2022-2933

The 0mk Shortener plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 0.2. This is due to missing or incorrect nonce validation on the zeromkoptionspage function. This makes it possible for unauthenticated attackers to inject malicious web scripts vi...

Improper access control

A vulnerability was found in Little Apps Little Software Stats. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file inc/class.securelogin.php of the component Password Reset Handler. The manipulation leads to improper access controls. The...

cool-php-captcha 跨站脚本漏洞

cool-php-captcha is an application by the individual developer LaoWei. A cross-site scripting vulnerability exists in version 0.2 of cool-php-captcha, which stems from unknown code in the file example-form.php, and can be exploited to cause cross-site scripting using the input of an action-specif...

Sql injection

A vulnerability was found in mrtnmtth joomlamodeinsatzstats up to 0.2. It has been classified as critical. This affects the function getStatsByType of the file helper.php. The manipulation of the argument year leads to sql injection. Upgrading to version 0.3 is able to address this issue. The...

PT-2022-26179 · Apple · Apple Macos

Name of the Vulnerable Software and Affected Versions: super-xray versions 0.2-beta Description: A privilege escalation issue was discovered in super-xray, which is the GUI alternative for the vulnerability scanning tool xray. This issue resulted in inaccurate default xray permissions. The proble...

Super Xray 安全漏洞

Super Xray is an excellent vulnerability scanning tool by 4ra1n individual developers. A security vulnerability exists in Super Xray version 0.2-beta Linux and Mac OS systems, which can be exploited by attackers to elevate privileges...

Spoofing

super-xray is a vulnerability scanner xray GUI launcher. In version 0.1-beta, the URL is not filtered and directly spliced ??into the command, resulting in a possible RCE vulnerability. Users should upgrade to super-xray 0.2-beta...

pyanxdns 安全漏洞

pyanxdns is a Python package on PyPI from the Python Foundation. It is used for Python clients to communicate with the ANX DNS API. A security vulnerability exists in pyanxdns version 0.2, which stems from the installation of the request package when installing the pyanxdns package, and can be...