Znajdź podatności, zrozum powód priorytetu i sprawdź informacje u źródła.
Data publikacji: ostatnie 7 dni. Starsze wpisy dostępne w pełnym katalogu i widoku KEV. Dopasowanie kategorii lub producenta nie potwierdza podatności konkretnej wersji produktu.
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping.…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar()…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including,…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including,…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · ENCVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
CVSS
7,2
EPSS
0,24 %
Poprawka
Status poprawki nieustalony
Publikacja
Aktualizacja NVD
Podatności: opis, rekomendacja, CVSS, EPSS i daty źródłowe. Rekomendacja nie potwierdza podatności własnego zasobu.
The SureCart – Ecommerce Made Easy For Selling Physical Products, Digital Downloads, Subscriptions, Donations, & Payments plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'comment' parameter in all versions up to, and including, 4.9.4 due to insufficient input sanitization…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
Koha is vulnerable to SQL injection in the Most-circulated items report. The reports/cat_issues_top.pl script (sub calculate) concatenates the user-controlled Criteria, Filter, and Limit request parameters directly into dynamic SQL. Criteria is only prefix-normalized and never validated against an…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'targetUrl' parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,28 % · rekomendacja wg zapisanej polityki
The Mang Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'content' parameter in all versions up to, and including, 2.4.3 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
An Out-of-bounds Write vulnerability in the routing protocol daemon (rpd) of Juniper Networks Junos OS and Junos OS Evolved allows an adjacent unauthenticated attacker to cause a denial of service when IS-IS link protection and backup-selection are configured.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,27 % · rekomendacja wg zapisanej polityki
HtmlUnit Neko is an HtmlUnit adaptation of NekoHTML. Prior to 5.4.0, HTMLWriterFilter writes decoded TEXTAREA and TITLE character content without entity encoding because both elements are treated as special content. During a parse-and-serialize round trip, entity references inside these escapable…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The Photo Reviews for WooCommerce plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via the 'wcpr_image_upload_id' parameter in all versions up to, and including, 1.2.30 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The Ultra Addons for Contact Form 7 plugin for WordPress is vulnerable to Stored Cross-Site Scripting via File Upload in all versions up to, and including, 3.5.54 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
IBM Maximo Application Suite - Location Service for Esri Component 9.2, 9.1, and 9.0 is vulnerable to improper access control due to a schema-less Custom Resource Definition.
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,26 % · rekomendacja wg zapisanej polityki
The Complianz GDPR/CCPA Cookie Consent Banner plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via yotu-wp Cookie-Blocker Filter in all versions up to, and including, 7.5.5 due to insufficient input sanitization and output escaping. This makes it possible for…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The WP Photo Album Plus plugin for WordPress is vulnerable to Stored Cross-Site Scripting via REQUEST_URI Session History in all versions up to, and including, 9.3.03.002 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Podlove Podcast Publisher plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Auphonic Webhook in all versions up to, and including, 4.5.6 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The CP Multi View Events Calendar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'CalendarTitle' parameter in all versions up to, and including, 1.4.42 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Opti-Behavior – Self-Hosted Heatmaps, Session Recordings, Funnels, A/B Testing & Smart Insights plugin for WordPress is vulnerable to Stored DOM-Based Cross-Site Scripting via 'country_name' Location Parameter in all versions up to, and including, 1.9.2.1 due to insufficient input sanitization…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The Salon Booking System – Appointment Booking for Salons, Barbershops & Spas plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'sln[<checkout-field-key>]' parameter in all versions up to, and including, 10.31.9 due to insufficient input sanitization and output escaping.…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The AcyMailing plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the customField[] parameter of the public frontusers::subscribe endpoint in versions up to, and including, 11.1.0. This is due to insufficient input sanitization and output escaping in the acym_cleanVar()…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,25 % · rekomendacja wg zapisanej polityki
The WPConsent – Cookie Banner & Cookie Consent for Privacy Compliance (GDPR / CCPA / EU Compliance Cookie Notice) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via Comment Content via Simple HTML DOM Parser Noise-Key Restoration (mXSS) in all versions up to, and including,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
n8n before 1.123.83, 2.41.4, and 2.42.1 contains a stored cross-site scripting vulnerability in the file-preview modal, which re-publishes binary data as an unsandboxed same-origin blob URL. A member who uploads a crafted item can run script in the n8n origin of whoever previews it, typically the…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
LlamaFarm through 0.0.34 contains an insecure default configuration that binds its unauthenticated FastAPI server to 0.0.0.0 on port 14345, while the lf CLI silently discards HOST overrides. Network-adjacent attackers can call the project and dataset management API to read stored provider API…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The NotificationX – FOMO, Live Sales Notification, WooCommerce Sales Popup, GDPR, Social Proof, Announcement Banner & Floating Notification Bar plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'name' parameter in all versions up to, and including, 3.3.3 due to insufficient…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The User Profile Builder – Beautiful User Registration Forms, User Profiles & User Role Editor plugin for WordPress is vulnerable to Stored Cross-Site Scripting via First Name Field in all versions up to, and including, 4.0.3 due to insufficient input sanitization and output escaping. This makes…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The Bit integrations – Form Integration, Webhook, Spreadsheets, CRM, LMS & Email Automation plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'field mapped to notification_content (attacker-chosen key, e.g. payload_text)' parameter in all versions up to, and including,…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The HivePress – Business Directory, Listings & Classified Ads Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the '<custom user attribute field name, e.g. profile_test>' parameter in all versions up to, and including, 1.7.31 due to insufficient input sanitization and…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
The VikBooking Hotel Booking Engine & PMS plugin for WordPress is vulnerable to Stored Cross-Site Scripting via 'attachments[name]' Parameter in all versions up to, and including, 1.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated…
Opis źródłowy NVD · EN
Obserwuj
CVSS 7,2 · EPSS 0,24 % · rekomendacja wg zapisanej polityki
7,2
0,24 %
Publikacja
Aktualizacja NVD
Źródła i pokrycie danych
Zakres katalogu: ostatnie 365 dni oraz wszystkie zachowane KEV.
NVD · publikacjeOstatnie przetworzenie zakończone
NVD · aktualizacjePrzetwarzanie niepełne
CISA KEVOstatnie przetworzenie zakończone
FIRST EPSSOstatnie przetworzenie zakończoneData modelu znajduje się przy rekordzie.