Category
Web / CMS
26,838 known vulnerabilities.
5,621 results · Clear filters · Feed
-
High 7.2
WP Coder – add custom html, css and js code <= 2.5.3 - Authenticated (Admin+) SQL Injection
The WP Coder – add custom html, css and js code plugin for WordPress is vulnerable to time-based SQL Injection via the ‘id’ parameter in versions up to, and including, 2.5.3 due to insufficient escaping on the user supplied parameter and lack of sufficient pr…
-
High 8.2
Moodle: possible to set the preferred "start page" of other users
The vulnerability was found Moodle which exists due to insufficient limitations on the "start page" preference. A remote attacker can set that preference for another user. The vulnerability allows a remote attacker to gain unauthorized access to otherwise res…
-
High 8.8
Cross-Site Request Forgery in Jenkins Azure Credentials Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins Azure Credentials Plugin 253.v887e0f9e898b and earlier allows attackers to connect to an attacker-specified web server.
-
High 7.7
WP Airbnb Review Slider < 3.3 - Subscriber+ SQLi
The WP Airbnb Review Slider WordPress plugin before 3.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
-
High 8.8
Customer Reviews for WooCommerce < 5.16.0 - Contributor+ LFI
The Customer Reviews for WooCommerce WordPress plugin before 5.16.0 does not validate one of its shortcode attribute, which could allow users with a contributor role and above to include arbitrary files via a traversal attack. This could also allow them to re…
-
High 8.8
Enable Media Replace < 4.0.2 - Author+ Arbitrary File Upload
The Enable Media Replace WordPress plugin before 4.0.2 does not prevent authors from uploading arbitrary files to the site, which may allow them to upload PHP shells on affected sites.
-
High 8.8
WP Google Review Slider < 11.8 - Subscriber+ SQLi
The WP Google Review Slider WordPress plugin before 11.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
-
High 7.7
Simple URLs < 115 - Subscriber+ SQLi
The Simple URLs WordPress plugin before 115 does not escape some parameters before using them in various SQL statements used by AJAX actions available by any authenticated users, leading to a SQL injection exploitable by low privilege users such as subscriber.
-
High 7.2
Mapwiz <= 1.0.1 - Admin+ SQLi
The Mapwiz WordPress plugin through 1.0.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
-
High 8.8
WP Review Slider < 12.2 - Subscriber+ SQLi
The WP Review Slider WordPress plugin before 12.2 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
-
High 8.8CVE-2023-0261 Scanner template
WP TripAdvisor Review Slider < 10.8 - Subscriber+ SQLi
The WP TripAdvisor Review Slider WordPress plugin before 10.8 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as subscriber.
-
High 8.8
Pinpoint Booking System < 2.9.9.2.9 - Subscriber+ SQLi
The Pinpoint Booking System WordPress plugin before 2.9.9.2.9 does not validate and escape one of its shortcode attributes before using it in a SQL statement, which could allow any authenticated users, such as subscriber to perform SQL Injection attacks.
-
High 8.8
ImageMagick Engine <= 1.7.5 - Cross-Site Request Forgery to PHAR Deserialization
The ImageMagick Engine plugin for WordPress is vulnerable to deserialization of untrusted input via the 'cli_path' parameter in versions up to, and including 1.7.5. This makes it possible for unauthenticated users to call files using a PHAR wrapper, granted t…
-
High 8.8
Persisted Cross-Site Scripting in Frontend Rendering in typo3
TYPO3 is a free and open source Content Management Framework released under the GNU General Public License. In affected versions the TYPO3 core component `GeneralUtility::getIndpEnv()` uses the unfiltered server environment variable `PATH_INFO`, which allows …
-
High 7.2
WOOF - Products Filter for WooCommerce < 1.3.2 - Admin+ PHP Object Injection
The HUSKY WordPress plugin before 1.3.2 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
-
High 8.8CVE-2023-0234 EPSS 18%
SiteGround Security < 1.3.1 - Admin+ SQLi
The SiteGround Security WordPress plugin before 1.3.1 does not properly sanitize user input before using it in an SQL query, leading to an authenticated SQL injection issue.
-
High 7.1
When query caching is enabled in Grafana users can query another users session
Grafana is an open-source platform for monitoring and observability. When datasource query caching is enabled, Grafana caches all headers, including `grafana_session`. As a result, any user that queries a datasource where the caching is enabled can acquire an…
-
High 7.2
Revive Old Posts – Social Media Auto Post and Scheduling Plugin < 9.0.11 - PHP Object Injection
The Revive Old Posts WordPress plugin before 9.0.11 unserializes user input provided via the settings, which could allow high privilege users such as admin to perform PHP Object Injection when a suitable gadget is present.
-
High 7.5
AAWP < 3.12.3 - Unsafe URL Handling
The AAWP WordPress plugin before 3.12.3 can be used to abuse trusted domains to load malware or other files through it (Reflected File Download) to bypass firewall rules in companies.
-
High 7.3
Grafana stored XSS in FileUploader component
Grafana is an open-source platform for monitoring and observability. Starting with the 8.1 branch and prior to versions 8.5.16, 9.2.10, and 9.3.4, Grafana had a stored XSS vulnerability affecting the core plugin GeoMap. The stored XSS vulnerability was possib…
-
High 8.2
ContentStudio <= 1.2.5 - Authorization Bypass
The ContentStudio plugin for WordPress is vulnerable to authorization bypass due to an unsecure token check that is susceptible to type juggling in versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to execute functions…
-
High 7.5
ContentStudio <= 1.2.5 - Information Exposure
The ContentStudio plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 1.2.5. This could allow unauthenticated attackers to obtain a nonce needed for the creation of posts.
-
High 8.1
Quick Restaurant Menu <= 2.0.2 - Missing Authorization
The Quick Restaurant Menu plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on its AJAX actions in versions up to, and including, 2.0.2. This makes it possible for authenticated attackers, with subscriber-level permi…
-
High 8.1
Quick Restaurant Menu <= 2.0.2 - Cross-Site Request Forgery
The Quick Restaurant Menu plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.0.2. This is due to missing or incorrect nonce validation on its AJAX actions. This makes it possible for unauthenticated attackers …
-
High 8.1
Quick Restaurant Menu <= 2.0.2 - Insecure Direct Object Reference
The Quick Restaurant Menu plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 2.0.2. This is due to the fact that during menu item deletion/modification, the plugin does not verify that the post ID provided…
-
High 7.2
OpenMage LTS DataFlow upload remote code execution vulnerability
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, an administrator with the permissions to upload files via DataFlow and to create products was able to execute arbitrary code via the convert profile. Versions 19.4.22 and 20.0.19 c…
-
High 8.8
OpenMage LTS authenticated remote code execution through layout update
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, a layout block was able to bypass the block blacklist to execute remote code. Versions 19.4.22 and 20.0.19 contain a patch for this issue.
-
High 7.2
OpenMage LTS arbitrary file deletion in customer media allows for remote code execution
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Magento admin users with access to the customer media could execute code on the server. Versions 19.4.22 and 20.0.19 contain a patch for this issue.
-
High 7.2
OpenMage LTS arbitrary command execution in custom layout update through blocks
OpenMage LTS is an e-commerce platform. Prior to versions 19.4.22 and 20.0.19, Custom Layout enabled admin users to execute arbitrary commands via block methods. Versions 19.4.22 and 20.0.19 contain patches for this issue.
-
High 8.8
CSRF vulnerability in Jenkins Orka Plugin allow capturing credentials
A cross-site request forgery (CSRF) vulnerability in Jenkins Orka by MacStadium Plugin 1.31 and earlier allows attackers to connect to an attacker-specified HTTP server using attacker-specified credentials IDs obtained through another method, capturing creden…
-
High 8.8
CSRF vulnerability in Jenkins TestQuality Updater Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins TestQuality Updater Plugin 1.3 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified username and password.
-
High 8.8
Cross-site request forgery vulnerability in Jenkins BearyChat Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins BearyChat Plugin 3.0.2 and earlier allows attackers to connect to an attacker-specified URL.
-
High 8.8
Insufficient Session Expiration in Jenkins Azure AD Plugin
Jenkins Azure AD Plugin 303.va_91ef20ee49f and earlier does not invalidate the previous session on login.
-
High 8.8
Cross-site request forgery vulnerability in Jenkins RabbitMQ Consumer Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins RabbitMQ Consumer Plugin 2.8 and earlier allows attackers to connect to an attacker-specified AMQP(S) URL using attacker-specified username and password.
-
High 8.8
CSRF vulnerability in Jenkins GitHub Pull Request Builder Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins GitHub Pull Request Builder Plugin 1.42.2 and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, capturing cre…
-
High 8.8
Session fixation vulnerability in Jenkins OpenId Connect Authentication Plugin
Jenkins OpenId Connect Authentication Plugin 2.4 and earlier does not invalidate the previous session on login.
-
High 8.8
Cross-site request forgery vulnerability in Jenkins OpenID Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins OpenID Plugin 2.4 and earlier allows attackers to trick users into logging in to the attacker's account.
-
High 8.8CVE-2023-24422 Public exploit
Sandbox bypass in Jenkins Script Security Plugin
A sandbox bypass vulnerability involving map constructors in Jenkins Script Security Plugin 1228.vd93135a_2fb_25 and earlier allows attackers with permission to define and run sandboxed scripts, including Pipelines, to bypass the sandbox protection and execut…
-
High 8.8
Cross-site request forgery vulnerability in Jenkins JIRA Pipeline Steps Plugin
A cross-site request forgery (CSRF) vulnerability in Jenkins JIRA Pipeline Steps Plugin 2.0.165.v8846cf59f3db and earlier allows attackers to connect to an attacker-specified URL using attacker-specified credentials IDs obtained through another method, captur…
-
High 8.8
Booster for WooCommerce - Multiple CSRF
The Booster for WooCommerce WordPress plugin before 6.0.1, Booster Plus for WooCommerce WordPress plugin before 6.0.1, Booster Elite for WooCommerce WordPress plugin before 6.0.1 have either flawed CSRF checks or are missing them completely in numerous places…