GHSA-7MG5-RW39-Q67F himiklab yii2-jqgrid-widget vulnerable to SQL Injection

A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to version 1.0.8 can address this issue. The...

himiklab yii2-jqgrid-widget vulnerable to SQL Injection

A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to version 1.0.8 can address this issue. The...

Sql injection

A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to version 1.0.8 is able to address this...

CVE-2014-125051 himiklab yii2-jqgrid-widget JqGridAction.php addSearchOptionsRecursively sql injection

A vulnerability was found in himiklab yii2-jqgrid-widget up to 1.0.7. It has been declared as critical. This vulnerability affects the function addSearchOptionsRecursively of the file JqGridAction.php. The manipulation leads to sql injection. Upgrading to version 1.0.8 is able to address this...

CVE-2014-125051

The CVE-2014-125051 entry concerns himiklab yii2-jqgrid-widget (up to 1.0.7). A vulnerability in addSearchOptionsRecursively (JqGridAction.php) allows SQL injection. Root cause: improper handling in the affected function leading to data-exposure/modify risk. Publicly stated impact is high/critica...

WordPress WP Social Widget Plugin < 2.2.4 is vulnerable to Cross Site Scripting (XSS)

Software WP Social Widget Type Plugin Vulnerable versions 2.2.4 Fixed in 2.2.4 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0074 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID bf482e991e69 Credits István Márton...

WP Social Widget < 2.2.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. wpsw facebook='" onmouseover="alert1"'...

WP Social Widget < 2.2.4 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. PoC wpsw facebook='" onmouseover="alert1"'...

PT-2023-10121 · Himiklab · Yii2-Jqgrid-Widget

Name of the Vulnerable Software and Affected Versions: himiklab yii2-jqgrid-widget versions up to 1.0.7 Description: A critical issue affects the addSearchOptionsRecursively function of the file JqGridAction.php, leading to sql injection. Recommendations: For himiklab yii2-jqgrid-widget versions ...

yii2 SQL注入漏洞

yii2 is a fast, secure and professional PHP framework. An SQL injection vulnerability exists in himiklab yii2-jqgrid-widget version 1.0.7 and earlier. An attacker could exploit this vulnerability to perform a sql injection attack...

Widgets for Google Reviews < 9.8 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Exploit...

WordPress Blog Designer - Post and Widget Plugin < 2.4.1 is vulnerable to Cross Site Scripting (XSS)

Software Blog Designer - Post and Widget Type Plugin Vulnerable versions 2.4.1 Fixed in 2.4.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4793 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID d4fed6181a18 Credits Istv...

Icon Widget < 1.3.0 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Exploit:...

Icon Widget < 1.3.0 - Contributor+ Stored XSS via Shortcode

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC Exploit:...

WordPress Icon Widget Plugin < 1.3.0 is vulnerable to Cross Site Scripting (XSS)

Software Icon Widget Type Plugin Vulnerable versions 1.3.0 Fixed in 1.3.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4763 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 818cb8e834a0 Credits István Márton Required...

CVE-2022-4329 Product list Widget for Woocommerce <= 1.0 - Reflected XSS

The Product list Widget for Woocommerce WordPress plugin through 1.0 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users such as high privilege one like...

WordPress plugin Product list Widget for Woocommerce 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-14187 · WordPress · The Product List Widget For Woocommerce

Name of the Vulnerable Software and Affected Versions: The Product list Widget for Woocommerce WordPress plugin through 1.0 Description: The issue is related to a Reflected Cross-Site Scripting that could be used against both unauthenticated and authenticated users, including high-privilege ones...

Yii2 FileAPI Widget vulnerable to Cross-site Scripting

A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched...

GHSA-J82X-FH8H-326G Yii2 FileAPI Widget vulnerable to Cross-site Scripting

A vulnerability was found in vova07 Yii2 FileAPI Widget up to 0.1.8. It has been declared as problematic. Affected by this vulnerability is the function run of the file actions/UploadAction.php. The manipulation of the argument file leads to cross site scripting. The attack can be launched...