M0Ze

A persistent cross-site scripting issue allows authenticated attackers to inject malicious HTML and JavaScript code. This occurs via the proposal description field through the 'create proposal' endpoint. The injected code executes when administrators or other users view the stored proposal, which can lead to malicious redirects and the theft of cookies.

A stored cross-site scripting issue allows unauthenticated attackers to inject malicious scripts via the chat input field. By submitting payloads containing script tags and event handlers, attackers can execute code within the admin area, which may lead to cookie theft or forced redirects to malicious websites.

The issue allows authenticated options change in the Biplob018 Shortcode Addons plugin at WordPress.

The issue concerns an authenticated WordPress options change vulnerability. It is related to Biplob Adhikari's Flipbox plugin at WordPress.

The issue is related to an authenticated WordPress Options Change vulnerability. It affects Biplob Adhikari's Tabs plugin at WordPress, where a high-role user can authenticate and change options.

The issue concerns Multiple Broken Access Control vulnerabilities. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

The issue concerns multiple authenticated Persistent Cross-Site Scripting (XSS) vulnerabilities. These vulnerabilities require an attacker to have at least a contributor or higher user role. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue concerns multiple authenticated SQL Injection vulnerabilities. These vulnerabilities can be exploited by users with a subscriber or higher user role. The estimated number of potentially affected devices worldwide is not specified. There is no information provided about real-world incidents where this issue was exploited.

The issue is related to an Unauthenticated Arbitrary Option Update vulnerability. This allows for unauthorized modifications to options.

The issue concerns an Unauthenticated WordPress Options Change vulnerability. This allows unauthorized changes to WordPress options.

The issue is related to reflected Cross-Site Scripting due to insufficient input sanitization and output escaping on the `frameid` parameter found in the ~/src/Package/views/shortcode-iframe.php file.

The issue allows high privilege users to set malicious JavaScript payload due to a lack of sanitization in the `updraft service` settings, leading to a Stored Cross-Site Scripting issue.

Name of the Vulnerable Software and Affected Versions: NewsOne CMS version 1.1.0 Description: The issue allows attackers to upload arbitrary files, potentially leading to webshell uploads and the execution of arbitrary commands. This is due to a vulnerability in the file upload component, specifically the `user image` input field. Recommendations: For NewsOne CMS version 1.1.0, consider disabling the file upload feature, particularly the `user image` component, until a patch is available to prevent potential exploitation. Restrict access to this component to minimize the risk of arbitrary command execution.

The issue arises from the plugin not validating its `caching exclude urls` and `caching include query strings` settings before outputting them in a PHP file, which could lead to remote code execution (RCE).

The issue is related to an Authenticated Stored Cross-Site Scripting problem. It occurs because some settings are not properly sanitised or escaped before being saved and output in the admin dashboard. This can happen even when the unfiltered html capability is disallowed.

The issue allows high privilege users to use malicious JavaScript in the Bar Text settings, leading to a Stored Cross-Site Scripting issue. This issue will be triggered in the plugin's setting, as well as all front-page of the blog when the Welcome bar is active.

The issue allows high privilege users, such as admins, to set XSS payloads in the `heading text` and CSS settings due to a lack of sanitization, leading to Stored Cross-Site Scripting issues.

The issue allows low privilege users to use JavaScript payloads in parameters from the my-resume page, leading to a Stored Cross-Site Scripting issue. This is because the plugin did not sanitise or escape multiple of its parameters before outputting them in the page.

The issue allows high privilege users, such as admins, to set an XSS payload in the psb positioning settings, which will be executed in all pages of the blog. This occurs due to the plugin's failure to properly sanitise and validate its settings.

The issue allows high privilege users to set XSS payload on the `lyte yt api key` and `lyte notification` settings, leading to stored Cross-Site Scripting issues due to the lack of sanitization or escaping of these settings before outputting them back in the page.