Lucene search
+L

7258 matches found

Nuclei
Nuclei
added 2026/09/13 4:24 p.m.28 views

PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting

There is a Cross Site Scripting XSS vulnerability in the "action" parameter of index.php in PHPJabbers Make an Offer Widget v1.0. id: CVE-2023-40752 info: name: PHPJabbers Make an Offer Widget v1.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | There is a Cross Site...

6.1CVSS6.3AI score0.01034EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.54 views

Advanced Text Widget < 2.0.2 - Cross-Site Scripting

A cross-site scripting XSS vulnerability in advancedtext.php in Advanced Text Widget plugin before 2.0.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the page parameter. id: CVE-2011-4618 info: name: Advanced Text Widget 2.0.2 - Cross-Site Scripting author:...

4.3CVSS5.9AI score0.10083EPSS
SaveExploits2References5
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.96 views

Wordpress Polls Widget < 1.5.3 - SQL Injection

The Poll, Survey, Questionnaire and Voting system WordPress plugin before 1.5.3 did not sanitise, escape or validate the dateanswers POST parameter before using it in a SQL statement when sending a Poll result, allowing unauthenticated users to perform SQL Injection attacks id: CVE-2021-24442 inf...

9.8CVSS8AI score0.45996EPSS
SaveExploits2References3
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.181 views

PHPJabbers Callback Widget v1.0 - Cross-Site Scripting

There is a Cross Site Scripting XSS vulnerability in the "theme" parameter of preview.php in PHPJabbers Callback Widget v1.0. id: CVE-2023-40755 info: name: PHPJabbers Callback Widget v1.0 - Cross-Site Scripting author: ritikchaddha severity: medium description: | There is a Cross Site Scripting...

6.1CVSS6.3AI score0.01254EPSS
SaveExploits0References2
Nuclei
Nuclei
added 2026/09/13 4:24 p.m.25 views

YesWiki Bazar Widget - Reflected XSS via 'id' Parameter

YesWiki's Bazar widget handler reflects the id GET parameter into HTML attributes using striptags only. striptags does not escape double quotes, allowing an attacker to break out of the data-formid attribute and inject arbitrary event handlers. id: CVE-2026-52774 info: name: YesWiki Bazar Widget ...

6.1CVSS6AI score0.00507EPSS
SaveExploits0References2
Kitploit
Kitploit
added 2026/09/13 3:50 p.m.5 views

jquery-cve-2022-31160

es-define-property Object.defineProperty, but not IE 8's broken one...

6.1CVSS6.7AI score0.0264EPSS
SaveExploits1References2
Kitploit
Kitploit
added 2026/09/13 3:40 p.m.9 views

CVE-2025-49029

🚨 WordPress Custom Login And Signup Widget 插件 🔥 基础分数: 9.1(严重) CWE ID: CWE-94 – 生成代码的控制不当('代码注入') 🧠 描述 该插件允许管理员通过设置页面中的发件人名称 字段修改 sn.php 的内容。 用户提供的输入被直接写入 PHP 文件 ,未经清理或验证。 因此,在 text 参数中提供的任何PHP代码都将被存储到PHP文件中,并在直接请求时执行,导致远程代码执行(RCE) 。 📍 漏洞端点 root@kitploit:...

9.1CVSS5.9AI score0.02197EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/13 9:55 a.m.7 views

CVE-2023-4800

ID de CVE: CVE-2023-4800 Tipo de Vulnerabilidad: Exposición de datos sensibles Descripción: El plugin DoLogin Security para WordPress es vulnerable al acceso no autorizado de datos debido a una verificación de capacidad faltante en el widget del panel de administración en versiones hasta la 3.7...

6.5CVSS6.6AI score0.00861EPSS
SaveExploits1
Kitploit
Kitploit
added 2026/09/13 9:51 a.m.11 views

snowpick

snowpick es un escáner de exposición de ServiceNow que detecta ACL de widgets mal configuradas, controles de acceso de la API REST y exposición de datos no autenticada. ServiceNow expone datos a través de dos superficies públicas comunes: los widgets de Service Portal y la API REST de tablas...

6AI score
SaveExploits0References1
Kitploit
Kitploit
added 2026/09/13 6:41 a.m.4 views

CVE-2022-48429_poc

CVE-2022-48429 - Youtrack 存储型 XSS NVD 数据库中的 CVE 描述不够准确。 以下是更准确的描述: Youtrack(版本 = 2022.3.65373)在仪表板中存在存储型 跨站脚本(XSS)漏洞。恶意低权限用户可以创建一个格式错误的仪表板并将其发送给其他用户(例如管理员)。这可能导致管理员账户被接管。 原作者:echo-devim 详细描述与概念验证(PoC) 在研究 Youtrack 版本 2022.3.65373 的安全性时,我发现了仪表板中的 XSS 漏洞。 非特权用户可以创建一个包含恶意小部件(其中注入了...

5.4CVSS6.1AI score0.00603EPSS
SaveExploits0
Kitploit
Kitploit
added 2026/09/12 11:33 p.m.13 views

CVE-2019-3396

CVE-2019-3396 🔎 主要信息: 受影响产品 : Confluence Server & Data Center 受影响版本 : 6.0.0 至 6.15.4 严重程度 : 严重 CVSS 9.8 原因 : Confluence 的 Widget Connector 插件(用于嵌入 YouTube、Vimeo 等外部视频和内容)。 该功能未正确验证用户输入 ,导致服务端模板注入(SSTI) 。 攻击者可发送恶意 payload → Confluence 使用 Velocity 模板引擎渲染 → 在服务器上执行代码。 1. 安装并启动网站 安装存在漏洞的版本,例如 6.9.0:...

10CVSS8.5AI score0.99913EPSS
SaveExploits20
Kitploit
Kitploit
added 2026/09/12 10:33 p.m.7 views

CVE-2019-3396

CVE-2019-3396 Confluence Widget Connector 路径遍历漏洞 CVE-2019-3396 RCE 验证代码 root@kitploit: POST /rest/tinymce/1/macro/preview HTTP/1.1 Host: x.x.x.x Connection: close Accept-Encoding: gzip, deflate Accept: / User-Agent: Mozilla/5.0 X11; Linux x8664; rv:60.0 Gecko/20100101 Firefox/60.0 Content-Type:...

10CVSS8.4AI score0.99913EPSS
SaveExploits20
EUVD
EUVD
added 2026/09/12 7:39 a.m.9 views

EUVD-2026-76833

The The Events Calendar plugin for WordPress is vulnerable to Remote Code Execution in all versions up to, and including, 6.17.3 via the parsearray function. This is due to insufficient validation of the widget 'classes' map, allowing a plain-array payload to bypass the issafewidgetinstance objec...

9.8CVSS0.00762EPSS
SaveExploits0References7
CVE
CVE
added 2026/09/12 7:39 a.m.59 views

CVE-2026-78159

The Events Calendar WordPress plugin (versions ≤ 6.17.3 ) is vulnerable to unauthenticated remote code execution via the Element_Classes::parse_array() function. Insufficient validation of the widget classes map allows a plain-array payload to bypass the is_safe_widget_instance() object check and...

9.8CVSS0.00762EPSS
SaveExploits0References7
EUVD
EUVD
added 2026/09/12 6:00 a.m.8 views

EUVD-2026-76786

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

8.8CVSS0.00276EPSS
SaveExploits0References1
CVE
CVE
added 2026/09/12 6:00 a.m.11 views

CVE-2026-81742

CVE-2026-81742 affects the BE REST Endpoints WordPress plugin through version 1.0.0 . The plugin's REST endpoints handle widget read, create, update, and delete operations without performing authorization checks and without sanitizing the values it stores. This allows unauthenticated attackers to...

8.8CVSS0.00276EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/09/12 6:00 a.m.34 views

CVE-2026-81742 BE REST Endpoints <= 1.0.0 - Unauthenticated Stored XSS and Widget Manipulation

The BE REST Endpoints WordPress plugin through 1.0.0 does not perform any authorization check before allowing widgets to be read, created, updated and deleted, and does not sanitize the values it stores in them, allowing unauthenticated users to inject arbitrary web scripts which will execute in...

0.00276EPSS
SaveExploits0References1
EUVD
EUVD
added 2026/09/12 6:00 a.m.10 views

EUVD-2026-76817

The Custom Menu Wizard Widget WordPress plugin through 3.3.1 does not sanitize and escape several shortcode attributes before rendering them into HTML, allowing users with contributor-level access and above to inject arbitrary web scripts that execute when the affected content is viewed...

6.8CVSS0.00235EPSS
SaveExploits0References1
NVD
NVD
added 2026/09/11 4:17 a.m.8 views

CVE-2026-15462

The Sticky Chat Widget plugin for WordPress is vulnerable to SQL Injection via the 'scwformfields' parameter array keys of the 'scwsaveformdata' AJAX action in versions up to, and including, 1.4.2. This is due to the saveformdata function passing attacker-controlled POST array keys unsanitized to...

7.5CVSS0.00304EPSS
SaveExploits0References5
CVE
CVE
added 2026/09/11 3:39 a.m.15 views

CVE-2026-15462

CVE-2026-15462 affects the Sticky Chat Widget WordPress plugin in versions up to and including 1.4.2 . The vulnerability is an unauthenticated SQL injection via the scw_form_fields parameter array keys in the scw_save_form_data AJAX action. The save_form_data() function passes attacker-controlled...

7.5CVSS0.00304EPSS
SaveExploits0References5
Rows per page
Query Builder