Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into the page HTML)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar()…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including,…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
CVSS
7,2
EPSS
0,23 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The FunnelKit – Funnel Builder for WooCommerce Checkout plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'shipping_first_name' parameter in all versions up to, and including, 3.16.0.5 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,3 % · rekomendacja wg zapisanej polityki
The LazyLoad Plugin – Lazy Load Images, Videos, and Iframes plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment_content (rendered inline into the page HTML)' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The Real Estate Manager – Property Listing and Agent Management plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'first_name' parameter in all versions up to, and including, 7.3 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
The Groundhogg — CRM, Newsletters, and Marketing Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'ref' parameter in all versions up to, and including, 4.5.14 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,29 % · rekomendacja wg zapisanej polityki
n8n before 1.123.83 contains an authorization bypass vulnerability that allows shared-workflow editors to use credentials they cannot access by embedding them in nested or tool inline sub-workflows. Attackers can save workflows with Workflow Tool or Workflow Retriever inline definitions…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar()…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Quiz and Survey Master (QSM) – Quiz Maker & Survey Maker plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'qsm_hidden_questions' parameter in all versions up to, and including, 11.2.6 due to insufficient input sanitization and output escaping. This makes it…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The WP Meteor Website Speed Optimization Addon plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Author Name in all versions up to, and including, 3.4.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The 10Web Booster – Website speed optimization, Cache & Page Speed optimizer plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'author' parameter in all versions up to, and including, 2.34.8 due to insufficient input sanitization and output escaping. This makes it possible…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Presto Player plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via <presto-player> Tag in all versions up to, and including, 4.5.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Mang Board WP plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data_type' parameter in all versions up to, and including, 2.4.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Post Grid Gutenberg Blocks – PostX plugin for WordPress is vulnerable to Stored Cross-Site Scripting via display_name User Field in all versions up to, and including, 5.1.0 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Premium Packages – Sell Digital Products Securely plugin for WordPress is vulnerable to Unauthenticated Stored Cross-Site Scripting via 'order_email' in all versions up to, and including, 7.0.5 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,23 % · rekomendacja wg zapisanej polityki
7,2
0,23 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.