Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
1,520 results · page 17 of 31
Jan 26, 2023The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vuCVE-2023-0448 · WordPress plugins & themes · reported by vulnreport@tenable.comMedium 6.1
The WP Helper Lite WordPress plugin, in versions < 4.3, returns all GET parameters unsanitized in the response, resulting in a reflected cross-site scripting vulnerability.
- Fixed in
- 4.3
- What to do
- Update the plugin to 4.3 or newer.
Full record and what to do →NVD recordtenable.comtenable.com
Jan 23, 2023CBX Petition for: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4383 · WordPress plugins & themes · reported by WPScanCritical 9.8
The CBX Petition for WordPress plugin through 1.0.3 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- CBX Petition for
- Affected
- up to 1.0.3
- What to do
- Affects up to 1.0.3. Update CBX Petition for to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 18, 2023Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task cCVE-2023-0290 · Other software · Rapid7 · reported by cve@rapid7.comMedium 4.3
Rapid7 Velociraptor did not properly sanitize the client ID parameter to the CreateCollection API, allowing a directory traversal in where the collection task could be written. It was possible to provide a client id of "../clients/server" to schedule the collection for the server (as a server artifact), but only require privileges to schedule collections on the client. Normally, to schedule an artifact on the server, the COLLECT_SERVER permission is required. This permission is normally only granted to "administrator" role. Due to this issue, it is sufficient to have the COLLECT_CLIENT privilege, which is normally granted to the "investigator" role. To exploit this vulnerability, the attacker must already have a Velociraptor user account at least "investigator" level, and be able to authenticate to the GUI and issue an API call to the backend. Typically, most users deploy Velociraptor with limited access to a trusted group, and most users will already be administrators within the GUI. This issue affects Velociraptor versions before 0.6.7-5. Version 0.6.7-5, released January 16, 2023, fixes the issue.
- Product
- Velociraptor
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 16, 2023Fontsy: Does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated usersCVE-2022-4447 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Fontsy WordPress plugin through 1.8.6 does not properly sanitize and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection.
- Product
- Fontsy
- Affected
- up to 1.8.6
- What to do
- Affects up to 1.8.6. Update Fontsy to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 16, 2023Custom Post Types and Custom Fields creator: Does not sanitize and escape some of its settingsCVE-2022-4442 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Custom Post Types and Custom Fields creator WordPress plugin before 2.3.3 does not sanitize and escape some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Custom Post Types and Custom Fields creator
- Fixed in
- 2.3.3
- What to do
- Update Custom Post Types and Custom Fields creator to 2.3.3 or newer.
Jan 16, 2023WordPress Events Calendar: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4320 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WordPress Events Calendar WordPress plugin before 1.4.5 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against both unauthenticated and authenticated users (such as high-privilege ones like admin).
- Product
- WordPress Events Calendar
- Fixed in
- 1.4.5
- What to do
- Update WordPress Events Calendar to 1.4.5 or newer.
Jan 16, 2023MonsterInsights: Does not sanitize or escape page titles in the top posts/pages sectionCVE-2022-3904 · WordPress plugins & themes · reported by WPScanMedium 6.1
The MonsterInsights WordPress plugin before 8.9.1 does not sanitize or escape page titles in the top posts/pages section, allowing an unauthenticated attacker to inject arbitrary web scripts into the titles by spoofing requests to google analytics.
- Product
- MonsterInsights
- Fixed in
- 8.9.1
- What to do
- Update MonsterInsights to 8.9.1 or newer.
Jan 16, 2023Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticaCVE-2022-43717 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.4
Dashboard rendering does not sufficiently sanitize the content of markdown components leading to possible XSS attack vectors that can be performed by authenticated users with create dashboard permissions. This issue affects Apache Superset version 1.5.2 and prior versions and version 2.0.0.
- Product
- Apache Superset
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordlists.apache.orglists.apache.org
Jan 14, 2023Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2.CVE-2023-0302 · Other software · radareorg · reported by security@huntr.devHigh 7.8
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository radareorg/radare2 prior to 5.8.2.
- Product
- radareorg/radare2
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 13, 2023Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access.CVE-2022-42136 · Other software · Mailenable · reported by MITREHigh 8.8
Authenticated mail users, under specific circumstances, could add files with unsanitized content in public folders where the IIS user had permission to access. That action, could lead an attacker to store arbitrary code on that files and execute RCE commands.
- Product
- Mailenable
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpastebin.commailenable.com
Jan 9, 2023Bg Bible References: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2022-4374 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Bg Bible References WordPress plugin through 3.8.14 does not sanitize and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- Product
- Bg Bible References
- Affected
- up to 3.8.14
- What to do
- Affects up to 3.8.14. Update Bg Bible References to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 9, 2023WP CSV: Does not sanitize and escape a parameter before outputting it back in the pageCVE-2022-4368 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP CSV WordPress plugin through 1.8.0.0 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, and doe snot have CSRF checks in place as well, leading to a Reflected Cross-Site Scripting.
- Product
- WP CSV
- Affected
- up to 1.8.0.0
- What to do
- Affects up to 1.8.0.0. Update WP CSV to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 4, 2023The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS.CVE-2023-22461 · Other software · mattkrick · reported by GitHubHigh 7.6
The `sanitize-svg` package, a small SVG sanitizer to prevent cross-site scripting attacks, uses a deny-list-pattern to sanitize SVGs to prevent XSS. In doing so, literal `<script>`-tags and on-event handlers were detected in versions prior to 0.4.0. As a result, downstream software that relies on `sanitize-svg` and expects resulting SVGs to be safe, may be vulnerable to cross-site scripting. This vulnerability was addressed in v0.4.0. There are no known workarounds
- Product
- sanitize-svg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Jan 2, 2023Quote-O-Matic: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4373 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Quote-O-Matic WordPress plugin through 1.0.5 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin.
- Product
- Quote-O-Matic
- Affected
- up to 1.0.5
- What to do
- Affects up to 1.0.5. Update Quote-O-Matic to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4372 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
- Product
- Web Invoice
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Web Invoice: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4371 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Web Invoice WordPress plugin through 2.1.3 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL Injection exploitable by high privilege users such as admin by default. However, depending on the plugin configuration, other users, such as subscriber could exploit this as well
- Product
- Web Invoice
- Affected
- up to 2.1.3
- What to do
- Affects up to 2.1.3. Update Web Invoice to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023multimedial images: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4370 · WordPress plugins & themes · reported by WPScanHigh 7.2
The multimedial images WordPress plugin through 1.0b does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- multimedial images
- Affected
- up to 1.0b
- What to do
- Affects up to 1.0b. Update multimedial images to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP-Lister Lite for Amazon: Does not sanitize and escapes a parameter before outputting it back in the pageCVE-2022-4369 · WordPress plugins & themes · reported by WPScanMedium 6.1
The WP-Lister Lite for Amazon WordPress plugin before 2.4.4 does not sanitize and escapes a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which can be used against high-privilege users such as admin.
- Product
- WP-Lister Lite for Amazon
- Fixed in
- 2.4.4
- What to do
- Update WP-Lister Lite for Amazon to 2.4.4 or newer.
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4360 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4359 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP RSS By Publishers: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4358 · WordPress plugins & themes · reported by WPScanHigh 7.2
The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- WP RSS By Publishers
- Affected
- up to 0.1
- What to do
- Affects up to 0.1. Update WP RSS By Publishers to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Qe SEO Handyman: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4352 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Qe SEO Handyman
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Qe SEO Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023Qe SEO Handyman: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4351 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin
- Product
- Qe SEO Handyman
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Qe SEO Handyman to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Jan 2, 2023WP User: Does not properly sanitize and escape a parameter before using it in a SQL statementCVE-2022-4049 · WordPress plugins & themes · reported by WPScanCritical 9.8
The WP User WordPress plugin through 7.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users.
- Product
- WP User
- Affected
- up to 7.0
- What to do
- Affects up to 7.0. Update WP User to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Jan 2, 2023Team Members: Does not sanitize and escapes some of its settingsCVE-2022-3936 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Team Members WordPress plugin before 5.2.1 does not sanitize and escapes some of its settings, which could allow high-privilege users such as editors to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in a multisite setup).
- Product
- Team Members
- Fixed in
- 5.2.1
- What to do
- Update Team Members to 5.2.1 or newer.
Dec 27, 2022Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation.CVE-2020-36568 · Other software · github.com/revel/revel · reported by security@golang.orgHigh 7.5
Unsanitized input in the query parser in github.com/revel/revel before v1.0.0 allows remote attackers to cause resource exhaustion via memory allocation.
- Product
- github.com/revel/revel
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.CVE-2020-36567 · Other software · github.com/gin-gonic/gin · reported by security@golang.orgHigh 7.5
Unsanitized input in the default logger in github.com/gin-gonic/gin before v1.6.0 allows remote attackers to inject arbitrary log lines.
- Product
- github.com/gin-gonic/gin
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2022Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.CVE-2022-4721 · Other software · ikus060 · reported by security@huntr.devMedium 5.4
Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) in GitHub repository ikus060/rdiffweb prior to 2.5.5.
- Product
- ikus060/rdiffweb
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 26, 2022Menu Item Visibility Control: Doesn't sanitize and validate the "Visibility logic" option for WordPress menu itemsCVE-2021-24942 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Menu Item Visibility Control WordPress plugin through 0.5 doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment.
- Product
- Menu Item Visibility Control
- Affected
- up to 0.5
- What to do
- Affects up to 0.5. Update Menu Item Visibility Control to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 22, 2022SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML SaCVE-2022-34475 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
SVG <code><use></code> tags that referenced a same-origin document could have resulted in script execution if attacker input was sanitized via the HTML Sanitizer API. This would have required the attacker to reference a same-origin JavaScript file containing the script to be executed. This vulnerability affects Firefox < 102.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 22, 2022The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code> tags; however it incorrectly did not sanitize <code>xliCVE-2022-34473 · Computers, phones & browsers · Mozilla · reported by security@mozilla.orgMedium 6.1
The HTML Sanitizer should have sanitized the <code>href</code> attribute of SVG <code><use></code> tags; however it incorrectly did not sanitize <code>xlink:href</code> attributes. This vulnerability affects Firefox < 102.
- Product
- Firefox
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordbugzilla.mozilla.orgmozilla.org
Dec 21, 2022Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanitize the input provided by the user, whichCVE-2022-3183 · Other software · Dataprobe · reported by ics-cert@hq.dhs.govCritical 9.8
Dataprobe iBoot-PDU FW versions prior to 1.42.06162022 contain a vulnerability where a specific function does not sanitize the input provided by the user, which may expose the affected to an OS command injection vulnerability.
- Product
- iBoot-PDU FW
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 19, 2022Easy Video Player: Does not sanitize and escapes some parametersCVE-2022-3937 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Easy Video Player WordPress plugin before 1.2.2.3 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Easy Video Player
- Fixed in
- 1.2.2.3
- What to do
- Update Easy Video Player to 1.2.2.3 or newer.
Dec 16, 2022The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input.CVE-2022-47208 · Network & remote access · Netgear · reported by vulnreport@tenable.comHigh 8.8
The “puhttpsniff” service, which runs by default, is susceptible to command injection due to improperly sanitized user input. An unauthenticated attacker on the same network segment as the router can execute arbitrary commands on the device without authentication.
- Product
- Nighthawk Ax1800 Firmware
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtenable.comtenable.com
Dec 15, 2022A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0.CVE-2022-32763 · Other software · Lansweeper · reported by talos-cna@cisco.comMedium 6.1
A cross-site scripting (xss) sanitization vulnerability bypass exists in the SanitizeHtml functionality of Lansweeper lansweeper 10.1.1.0. A specially-crafted HTTP request can lead to arbitrary Javascript code injection. An attacker can send an HTTP request to trigger this vulnerability.
- Product
- lansweeper
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordtalosintelligence.comtalosintelligence.com
Dec 14, 2022rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.CVE-2022-23520 · Other software · rails · reported by GitHubMedium 6.1
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, there is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer due to an incomplete fix of CVE-2022-32209. Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both "select" and "style" elements. Code is only impacted if allowed tags are being overridden. This issue is patched in version 1.4.4. All users overriding the allowed tags to include both "select" and "style" should either upgrade or use this workaround: Remove either "select" or "style" from the overridden allowed tags. NOTE: Code is _not_ impacted if allowed tags are overridden using either the :tags option to the Action View helper method sanitize or the :tags option to the instance method SafeListSanitizer#sanitize.
- Product
- rails-html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Dec 14, 2022rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.CVE-2022-23519 · Other software · rails · reported by GitHubHigh 7.2
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Prior to version 1.4.4, a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags in either of the following ways: allow both "math" and "style" elements, or allow both "svg" and "style" elements. Code is only impacted if allowed tags are being overridden. . This issue is fixed in version 1.4.4. All users overriding the allowed tags to include "math" or "svg" and "style" should either upgrade or use the following workaround immediately: Remove "style" from the overridden allowed tags, or remove "math" and "svg" from the overridden allowed tags.
- Product
- rails-html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comhackerone.com
Dec 14, 2022rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.CVE-2022-23518 · Other software · rails · reported by GitHubMedium 6.1
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Versions >= 1.0.3, < 1.4.4 are vulnerable to cross-site scripting via data URIs when used in combination with Loofah >= 2.1.0. This issue is patched in version 1.4.4.
- Product
- rails-html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 14, 2022rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications.CVE-2022-23517 · Other software · rails · reported by GitHubHigh 7.5
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.
- Product
- rails-html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 13, 2022HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values.CVE-2022-23499 · Other software · TYPO3 · reported by GitHubMedium 6.1
HTML sanitizer is written in PHP, aiming to provide XSS-safe markup based on explicitly allowed tags, attributes and values. In versions prior to 1.5.0 or 2.1.1, malicious markup used in a sequence with special HTML CDATA sections cannot be filtered and sanitized due to a parsing issue in the upstream package masterminds/html5. This allows bypassing the cross-site scripting mechanism of typo3/html-sanitizer. The upstream package masterminds/html5 provides HTML raw text elements (`script`, `style`, `noframes`, `noembed` and `iframe`) as DOMText nodes, which were not processed and sanitized further. None of the mentioned elements were defined in the default builder configuration, that's why only custom behaviors, using one of those tag names, were vulnerable to cross-site scripting. This issue has been fixed in versions 1.5.0 and 2.1.1.
- Product
- html-sanitizer
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 12, 2022Donation Button: Does not sanitize and escapes some parametersCVE-2022-4005 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Donation Button WordPress plugin through 4.0.0 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
- Product
- Donation Button
- Affected
- up to 4.0.0
- What to do
- Affects up to 4.0.0. Update Donation Button to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Dec 12, 2022Essential Real Estate: Does not sanitize and escapes some parametersCVE-2022-3933 · WordPress plugins & themes · reported by WPScanMedium 5.4
The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.
- Product
- Essential Real Estate
- Fixed in
- 3.9.6
- What to do
- Update Essential Real Estate to 3.9.6 or newer.
Dec 12, 2022Cooked Pro: Does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore actionCVE-2022-3900 · WordPress plugins & themes · reported by WPScanCritical 9.8
The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability.
- Product
- Cooked Pro
- Fixed in
- 1.7.5.7
- What to do
- Update Cooked Pro to 1.7.5.7 or newer.
Dec 5, 2022WP OAuth Server (OAuth Authentication): Does not sanitize and escape Client IDsCVE-2022-3892 · WordPress plugins & themes · reported by WPScanMedium 4.8
The WP OAuth Server (OAuth Authentication) WordPress plugin before 4.2.2 does not sanitize and escape Client IDs, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup)
- Product
- WP OAuth Server (OAuth Authentication)
- Fixed in
- 4.2.2
- What to do
- Update WP OAuth Server (OAuth Authentication) to 4.2.2 or newer.
Dec 5, 2022Comic Book Management System: Does not sanitize and escape a parameter before using it in a SQL statementCVE-2022-3856 · WordPress plugins & themes · reported by WPScanHigh 7.2
The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin.
- Product
- Comic Book Management System
- Fixed in
- 2.2.0
- What to do
- Update Comic Book Management System to 2.2.0 or newer.
Full record and what to do →NVD recordbulletin.iese.dewpscan.com
Nov 28, 2022Salat Times: Does not sanitize and escapes its settingsCVE-2022-2983 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Salat Times WordPress plugin before 3.2.2 does not sanitize and escapes its settings, allowing high-privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
- Product
- Salat Times
- Fixed in
- 3.2.2
- What to do
- Update Salat Times to 3.2.2 or newer.
Nov 28, 2022Find and Replace All: Does not sanitize and escape some parameters from its setting page before outputting them back to the userCVE-2022-2311 · WordPress plugins & themes · reported by WPScanMedium 6.1
The Find and Replace All WordPress plugin before 1.3 does not sanitize and escape some parameters from its setting page before outputting them back to the user, leading to a Reflected Cross-Site Scripting issue.
- Product
- Find and Replace All
- Fixed in
- 1.3
- What to do
- Update Find and Replace All to 1.3 or newer.
Nov 21, 2022Evaluate: Does not sanitize and escapes some of its settingsCVE-2022-3753 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Evaluate WordPress plugin through 1.0 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Evaluate
- Affected
- up to 1.0
- What to do
- Affects up to 1.0. Update Evaluate to the newest version and check its changelog mentions this fix; if there isn’t one yet, deactivate it until there is.
Nov 21, 2022Spacer: Does not sanitize and escapes some of its settingsCVE-2022-3618 · WordPress plugins & themes · reported by WPScanMedium 4.8
The Spacer WordPress plugin before 3.0.7 does not sanitize and escapes some of its settings, which could allow high-privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example, in multisite setup).
- Product
- Spacer
- Fixed in
- 3.0.7
- What to do
- Update Spacer to 3.0.7 or newer.
Nov 14, 2022Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output.CVE-2022-43968 · Other software · Concretecms · reported by MITREMedium 6.1
Concrete CMS (formerly concrete5) below 8.5.10 and between 9.0.0 and 9.1.2 is vulnerable to Reflected XSS in the dashboard icons due to un-sanitized output. Remediate by updating to Concrete CMS 9.1.3+ or 8.5.10+.
- Product
- Concrete CMS
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddocumentation.concretecms.orgdocumentation.concretecms.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.