Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Pełny dostępny katalog: publikacje z ostatnich 365 dni oraz całe dostępne KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned…
Opis źródłowy NVD · ENCVSS 6,6 · EPSS 1,23 % · rekomendacja wg zapisanej polityki
The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
TP-Link Tapo
C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ
SOAP handlers. An authenticated ONVIF client can submit an excessive number of
preset-related elements, causing writes beyond the bounds of fixed-size stack
arrays and resulting in a crash of the affected…
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.
Opis źródłowy NVD · ENCVSS 6,8 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
CVSS
6,8
EPSS
0,22 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The Envira Gallery WordPress plugin before 1.16.1 does not sanitise and escape a gallery item identifier before outputting it in an image tag attribute, allowing users with the Author role and above to inject arbitrary web scripts that execute when any visitor, including an administrator, views a…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Horizontal scrolling announcements WordPress plugin through 2.6 does not sanitise and escape one of its announcement settings before outputting it into an attribute context on the front end, allowing users granted access to the announcement management page (Contributor and above, once…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Loco Translate WordPress plugin before 2.8.9 does not sanitise and escape some bundle configuration values before outputting them back in an admin page, allowing users with the translator capability and above to perform Stored Cross-Site Scripting attacks against high privilege users such as…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Kubio AI Page Builder WordPress plugin before 2.9.3 does not validate the URI scheme of a user-supplied value before outputting it as a link target, allowing users with the contributor role and above to store a payload which executes in the browser of anyone who follows the link, including an…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
An optional, separately licensed repository-connector feature in Kiteworks Core did not neutralize special characters in a user-supplied path before passing it to an external command. An authenticated system administrator could inject additional commands and write arbitrary content to files owned…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,6 · EPSS 1,23 % · rekomendacja wg zapisanej polityki
The Code Snippets WordPress plugin before 3.10.0 does not sanitise and escape a user-supplied parameter before using it in a SQL query in some of its snippet-migration import endpoints, which are accessible to any user holding site-administration capabilities; on a WordPress Multisite network…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The Animated Number Counters WordPress plugin before 3.1 does not sanitise or escape a value stored by an Editor-level user before concatenating it into a SQL query that runs when any unauthenticated visitor renders a page containing the counter, leading to second-order SQL injection that can read…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The MPG WordPress plugin before 4.2.3 does not properly validate the structure of imported project data before using it in a database query, allowing users with the Editor role or higher to perform SQL injection attacks and read sensitive data such as password hashes.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
Ericsson Packet Core Controller (PCC) versions prior to 1.39 contain a vulnerability in Configuration Management, allowing an attacker to execute specifically crafted commands to reveal system secret through error messages.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
The Royal Addons for Elementor WordPress plugin before 1.7.1066 does not validate some widget settings before outputting them inside an HTML attribute, which could allow users with the Contributor role and above to perform Stored Cross-Site Scripting attacks.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
TP-Link Tapo
C500 v2.0 contains an out-of-bounds stack write vulnerability in its ONVIF PTZ
SOAP handlers. An authenticated ONVIF client can submit an excessive number of
preset-related elements, causing writes beyond the bounds of fixed-size stack
arrays and resulting in a crash of the affected…
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
The Testimonials by BestWebSoft WordPress plugin through 1.0.8 does not sanitise and escape a parameter before using it in a SQL query, allowing unauthenticated attackers to append additional SQL to the query.
Opis źródłowy NVD · EN
Do wiadomości
CVSS 6,8 · EPSS 0,22 % · rekomendacja wg zapisanej polityki
6,8
0,22 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.