CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-44010 – WordPress Full frame theme <= 2.7.2 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-44010
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Catch Themes Full frame allows Stored XSS.This issue affects Full frame: from n/a through 2.7.2. The Full frame theme for WordPress is vulnerable to Stored Cross-Site Scripting parameter in versions up to, and including, 2.7.2 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/full-frame/wordpress-full-frame-theme-2-7-2-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4242 – FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Information Disclosure via Health Check
https://notcve.org/view.php?id=CVE-2023-4242
The FULL - Customer plugin for WordPress is vulnerable to Information Disclosure via the /health REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to obtain sensitive information about the site configuration as disclosed by the WordPress health check. • https://plugins.trac.wordpress.org/browser/full-customer/tags/1.1.0/app/api/Health.php https://www.wordfence.com/threat-intel/vulnerabilities/id/a77d0fb5-8829-407d-a40a-169cf0c5f837?source=cve • CWE-287: Improper Authentication CWE-863: Incorrect Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-4243 – FULL - Customer <= 2.2.3 - Authenticated(Subscriber+) Improper Authorization to Arbitrary Plugin Installation
https://notcve.org/view.php?id=CVE-2023-4243
The FULL - Customer plugin for WordPress is vulnerable to Arbitrary File Upload via the /install-plugin REST route in versions up to, and including, 2.2.3 due to improper authorization. This allows authenticated attackers with subscriber-level permissions and above to execute code by installing plugins from arbitrary remote locations including non-repository sources onto the site, granted they are packaged as a valid WordPress plugin. • https://plugins.trac.wordpress.org/browser/full-customer/tags/1.1.0/app/api/Plugin.php https://plugins.trac.wordpress.org/browser/full-customer/tags/2.2.1/app/api/PluginInstallation.php https://www.wordfence.com/threat-intel/vulnerabilities/id/9799df3f-e34e-42a7-8a72-fa57682f7014?source=cve • CWE-285: Improper Authorization CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 5.4EPSS: 0%CPEs: 1EXPL: 2CVE-2021-25791 – Online Doctor Appointment System 1.0 - 'Multiple' Stored XSS
https://notcve.org/view.php?id=CVE-2021-25791
Multiple stored cross site scripting (XSS) vulnerabilities in the "Update Profile" module of Online Doctor Appointment System 1.0 allows authenticated attackers to execute arbitrary web scripts or HTML via crafted payloads in the First Name, Last Name, and Address text fields. Múltiples vulnerabilidades de cross site scripting (XSS) almacenadas en el módulo "Update Profile" de Online Doctor Appointment System versión 1.0, permiten a atacantes autenticados ejecutar scripts web o HTML arbitrario por medio de cargas útiles diseñadas en los campos de texto First Name, Last Name y Address • https://www.exploit-db.com/exploits/49396 https://github.com/MrCraniums/CVE-2021-25791-Multiple-Stored-XSS https://www.sourcecodester.com https://www.sourcecodester.com/php/14663/online-doctor-appointment-system-php-full-source-code.html • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 1CVE-2006-2848 – aspWebLinks 2.0 - SQL Injection / Admin Pass Change
https://notcve.org/view.php?id=CVE-2006-2848
links.asp in aspWebLinks 2.0 allows remote attackers to change the administrative password, possibly via a direct request with a modified txtAdministrativePassword field. • https://www.exploit-db.com/exploits/1859 http://www.securityfocus.com/archive/1/435735/100/0/threaded •