760 matches found
CVE-2022-31456
A cross-site scripting XSS vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the team name parameter...
CVE-2022-31456
A cross-site scripting XSS vulnerability in Truedesk v1.2.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the team name parameter...
PT-2023-13038 · Trudesk · Trudesk
Name of the Vulnerable Software and Affected Versions: Truedesk version 1.2.2 Description: A cross-site scripting issue allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into a user chat box. Recommendations: For Truedesk version 1.2.2, consider disabling th...
Trudesk 跨站脚本漏洞
Trudesk is an open source helpdesk/ticketing solution from Trudesk, Inc. A security vulnerability exists in Trudesk version 1.2.2 that stems from the presence of a cross-site scripting XSS vulnerability. An attacker can exploit this vulnerability to execute arbitrary web script or HTML code via a...
Trudesk 跨站脚本漏洞
Trudesk is an open source helpdesk/ticketing solution from Trudesk, Inc. A security vulnerability exists in Trudesk version 1.2.2, which stems from a cross-site scripting XSS vulnerability in the parameter team name. An attacker can exploit this vulnerability to execute arbitrary web script or HT...
WordPress Audio Player with Playlist Ultimate Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Software Audio Player with Playlist Ultimate Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-38516 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID dabac0be2565 Credits Rio...
WordPress BuddyForms Attach Post with Group Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Software BuddyForms Attach Post with Group Type Plugin Vulnerable versions = 1.2.2 Fixed in 1.2.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 9d4312fdd8bd Credits Rafie Muhammad...
WordPress WP System Log Plugin < 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Software WP System Log Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID c875cf2db794 Credits Rafie Muhammad Patchstack Required...
WordPress Power Ups for Elementor Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Software Power Ups for Elementor Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 5f90ede97ce0 Credits Rafie Muhammad Patchstack...
WordPress a-staff – Team member showcase plugin for WordPress Plugin <= 1.2.2 is vulnerable to Cross Site Scripting (XSS)
Software a-staff – Team member showcase plugin for WordPress Type Plugin Vulnerable versions = 1.2.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 0b68c5a40cb8 Credit...
CVE-2023-35038
Cross-Site Request Forgery CSRF vulnerability in wpexperts.Io WP PDF Generator plugin = 1.2.2 versions...
WordPress Plugin WP PDF Generator 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports PHP and MySQL server set up a personal blog site. WordPress plugin is an application plug-in. A cross-site request forgery...
CVE-2021-4423 RAYS Grid <= 1.2.2 - Cross-Site Request Forgery Bypass
The RAYS Grid plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.2.2. This is due to missing or incorrect nonce validation on the rsgdinsertupdate function. This makes it possible for unauthenticated attackers to update post fields via a forged...
WordPress Plugin RAYS Grid 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...
WordPress Booking and Rental Manager Plugin <= 1.2.1 is vulnerable to Cross Site Scripting (XSS)
Software Booking and Rental Manager Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-35048 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 73d697a7ce84 Credits NeginNrb...
CVE-2023-2280
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajaxpublic' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin...
CVE-2023-2280
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajaxpublic' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin...
Design/Logic Flaw
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajaxpublic' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin...
CVE-2023-2280 WP Directory Kit <= 1.2.2 - Missing Authorization to Plugin Installation, Settings Change/Delete, Demo Import, Directory Kit Deletion via wdk_public_action
The WP Directory Kit plugin for WordPress is vulnerable to unauthorized modification of data and loss of data due to a missing capability check on the 'ajaxpublic' function in versions up to, and including, 1.2.2. This makes it possible for unauthenticated attackers to delete or change plugin...