CVE-2023-42573

CVE-2023-42573 describes a PendingIntent hijacking vulnerability in the Search Widget on Samsung devices, affecting China models prior to version 3.4 . The underlying flaw allows local attackers to access data through hijacked PendingIntents. Connected sources specify that vulnerable versions are...

CVE-2023-42573

PendingIntent hijacking vulnerability in Search Widget prior to version 3.4 in China models allows local attackers to access data...

SAMSUNG Mobile devices security vulnerability

SAMSUNG Mobile devices are a range of Samsung mobile devices, including cell phones, tablets, etc. from the South Korean company Samsung. A security vulnerability exists in SAMSUNG Mobile devices prior to version 3.4, which stems from a PendingIntent hijacking vulnerability in the Search Widget...

PT-2023-28443 · Unknown · Searchwidget

Name of the Vulnerable Software and Affected Versions: Search Widget versions prior to 3.4 Description: The issue allows local attackers to access data through a PendingIntent hijacking vulnerability in the Search Widget, specifically in China models. Recommendations: For versions prior to 3.4,...

CVE-2023-49926

app/Lib/Tools/EventTimelineTool.php in MISP before 2.4.179 allows XSS in the event timeline widget...

PT-2023-31413 · Misp · Misp

Name of the Vulnerable Software and Affected Versions: MISP versions prior to 2.4.179 Description: The issue allows for XSS in the event timeline widget. This is due to a problem in the app/Lib/Tools/EventTimelineTool.php file. Recommendations: For versions prior to 2.4.179, update to version...

WordPress Enhanced Text Widget Plugin <= 1.6.3 is vulnerable to Broken Access Control

Software Enhanced Text Widget Type Plugin Vulnerable versions = 1.6.3 Fixed in 1.6.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49192 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 8e44319396d6 Credits Abdi Pranata...

WordPress Crypto Converter Widget Plugin <= 1.8.3 is vulnerable to Cross Site Scripting (XSS)

Software Crypto Converter Widget Type Plugin Vulnerable versions = 1.8.3 Fixed in 1.8.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49150 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 6cbd695cc956 Credits Ngô Thiên An ancorn from...

CVE-2023-41810

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Pandora FMS on all allows Cross-Site Scripting XSS. This vulnerability allowed Javascript code to be executed in some Widgets' text box. This issue affects Pandora FMS: from 700 through 773...

WP Category Post List Widget <= 2.0.3 - Cross-Site Request Forgery via gen_set_page

Description The WP Category Post List Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.3. This is due to missing or incorrect nonce validation on the 'gensetpage' function. This makes it possible for unauthenticated attackers to modify...

PT-2023-28107 · Unknown · Pandora Fms

Name of the Vulnerable Software and Affected Versions: Pandora FMS versions 700 through 773 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting XSS. This allows Javascript code to be executed in some Widgets' text bo...

Better RSS Widget <= 2.8.1 - Authenticated (Contributor+) Stored Cross-Site Scripting

Description The Better RSS Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 2.8.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to...

Artica Pandora FMS Cross-Site Scripting Vulnerability

Artica Pandora FMS is a monitoring system from the Spanish company Artica. The system monitors networks, servers, virtual infrastructures, applications, etc. in a visual way. A cross-site scripting vulnerability exists in Artica Pandora FMS versions 700 through 773, which is caused due to an inpu...

WP Custom Widget area <= 1.2.5 - Missing Authorization

Description The WP Custom Widget area plugin for WordPress is vulnerable to unauthorized access of functionality due to a missing capability check on several functions corresponding to AJAX actions in versions up to, and including, 1.2.5. This makes it possible for authenticated attackers, with...

CVE-2023-47813

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in grandslambert Better RSS Widget plugin = 2.8.1 versions...

CVE-2023-47813

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in grandslambert Better RSS Widget plugin = 2.8.1 versions...

Cross site scripting

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in grandslambert Better RSS Widget plugin = 2.8.1 versions...

CVE-2023-47813 WordPress Better RSS Widget Plugin <= 2.8.1 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in grandslambert Better RSS Widget plugin = 2.8.1 versions...

CVE-2023-47813

CVE-2023-47813 relates to the WordPress plugin Better RSS Widget (

CVE-2023-5163

The Weather Atlas Widget plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'shortcode-weather-atlas' shortcode in versions up to, and including, 1.2.1 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticat...