Yii PHP Framework arbitrary PHP scripts execution

The CDetailView widget in Yii PHP Framework 1.1.14 allows remote attackers to execute arbitrary PHP scripts via vectors related to the value property...

Birthdays Widget <= 1.7.18 - Admin+ Stored Cross Site Scripting

The plugin does not sanitise and escape some of its fields, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed As admin, create/edit a Birthday and add the following payload in the Name field:...

WordPress Birthdays Widget plugin <= 1.7.18 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Rutuja Chaudhari in WordPress Birthdays Widget plugin versions = 1.7.18. Solution Deactivate and delete. This plugin has been closed as of April 8, 2022 and is not available for download. This closure is temporary, pending a full review...

XSS Injection Vulnerability

Impact Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied. Patches This has been patched in Craft 3.7.29. References https://github.com/craftcms/cms/blob/develop/CHANGELOG.md3729---2022-01-18 For more information If you hav...

GHSA-WF98-VXV9-JQFV XSS Injection Vulnerability

Impact Under some circumstances, the Feeds widget on the dashboard could have an XSS vulnerability if a malformed feed was supplied. Patches This has been patched in Craft 3.7.29. References https://github.com/craftcms/cms/blob/develop/CHANGELOG.md3729---2022-01-18 For more information If you hav...

CVE-2022-0887

The Easy Social Icons WordPress plugin before 3.1.4 does not sanitize the selectedicons attribute to the cnsswidget before using it in an SQL statement, leading to a SQL injection vulnerability...

CVE-2021-25113

The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues...

CVE-2021-25113

The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues...

CVE-2021-25113

The Dropdown Menu Widget WordPress plugin through 1.9.7 does not have authorisation and CSRF checks when saving its settings, allowing low privilege users such as subscriber to update them. Due to the lack of sanitisation and escaping, it could also lead to Stored Cross-Site Scripting issues...

WordPress plugin Dropdown Menu Widget 跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. WordPress Dropdown Menu Widget has a cross-site scripting vulnerability that can be exploited by attackers ...

The vulnerability of the Widget plugin and the Undo feature of the CKEditor WYSIWYG editor allows attackers to compromise data integrity.

The vulnerability of the Widget plugin and the Undo feature of the CKEditor WYSIWYG editor is related to the lack of measures taken to protect the structure of web pages. Exploiting this vulnerability allows an attacker to compromise the integrity of data...

Modern Events Calendar Lite < 6.4.7 - Reflected Cross-Site Scripting

The plugin does not escape some generated URLs before outputting them back in attributes, leading to Reflected Cross-Site Scripting PoC On a page where the Total Booking widget is displayed, append the following payload: "...

Fedora: Security Advisory for gtkspell3 (FEDORA-2022-6746739d52)

The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[SECURITY] Fedora 36 Update: gtkspell3-3.0.10-12.fc36

GtkSpell provides word-processor-style highlighting and replacement of misspelled words in a GtkTextView widget as you type. Right-clicking a misspelled word pops up a menu of suggested replacements...

[SECURITY] Fedora 36 Update: gtkspellmm30-3.0.5-17.fc36

GtkSpell provides word-processor-style highlighting and replacement of misspelled words in a GtkTextView widget as you type. Right-clicking a misspelled word pops up a menu of suggested replacements...

Ubuntu 18.04 LTS / 20.04 LTS : CKEditor vulnerabilities (USN-5340-1)

The remote Ubuntu 18.04 LTS / 20.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-5340-1 advisory. Kyaw Min Thein discovered that CKEditor incorrectly handled certain inputs. An attacker could possibly use this issue to execute arbitrary...

CVE-2021-24958 Meks Easy Photo Feed Widget < 1.2.4 - Subscriber+ Settings Update to Stored XSS

The Meks Easy Photo Feed Widget WordPress plugin before 1.2.4 does not have capability and CSRF checks in the mekssavebusinessselectedaccount AJAX action, available to any authenticated user, and does not escape some of the settings. As a result, any authenticated user, such as subscriber could...

CVE-2021-24958

CVE-2021-24958 affects the Meks Easy Photo Feed Widget WordPress plugin prior to version 1.2.4. Root cause: the meks_save_business_selected_account AJAX action lacks capability and CSRF checks and does not escape some settings, making it accessible to any authenticated user. Impact: any authentic...

WordPress plugin 跨站脚本漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress Meks Easy Photo Feed Widget has a cross-site scripting vulnerability that can be exploited by any...

jQuery UI Datepicker Widget Cross Site Scripting (CVE-2021-41182; CVE-2021-41183)

A cross site scripting vulnerability exists in the jQuery UI Datepicker widget. Successful exploitation of this vulnerability would allow remote attackers to inject an arbitrary web script into the affected system...