widgets project widgets vulnerabilities and exploits

(subscribe to this query)

The autocomplete callback in Autocomplete Widgets for Text and Number Fields (autocomplete_widgets) module 6.x-1.x prior to 6.x-1.4 and 7.x-1.x prior to 7.x-1.0-rc1 does not properly handle node permissions, which allows remote authenticated users to obtain sensitive field values...

Autocomplete Widgets Project Autocomplete Widgets 7.x-1.x Autocomplete Widgets Project Autocomplete Widgets 6.x-1.1 Autocomplete Widgets Project Autocomplete Widgets 6.x-1.2 Autocomplete Widgets Project Autocomplete Widgets 6.x-1.3 Autocomplete Widgets Project Autocomplete Widgets 6.x-1.0

Cross-site scripting (XSS) vulnerability in the Widgets extension for MediaWiki allows remote malicious users to inject arbitrary web script or HTML via vectors involving base64 encoded content.

Widgets Project Widgets -

An issue exists in the Widgets extension up to and including 1.4.0 for MediaWiki. Improper title sanitization allowed for the execution of any wiki page as a widget (as defined by this extension) via MediaWiki's {{#widget:}} parser function.

Widgets Project Widgets

The display-widgets plugin prior to 2.04 for WordPress has XSS via the wp-admin/admin-ajax.php?action=dw_show_widget id_base, widget_number, or instance parameter.

Display-widgets Project Display-widgets

Cross-Site Request Forgery (CSRF) vulnerability in AboZain,O7abeeb,UnitOne Custom Dashboard Widgets allows Cross-Site Scripting (XSS).This issue affects Custom Dashboard Widgets: from n/a up to and including 1.3.1.

Custom Dashboard Widgets Project Custom Dashboard Widgets

The Video Sidebar Widgets WordPress plugin up to and including 6.1 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored ...

Video Sidebar Widgets Project Video Sidebar Widgets

The Widgets on Pages WordPress plugin prior to 1.8.0 does not validate and escape its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against...

Widgets On Pages Project Widgets On Pages

The Sidebar Widgets by CodeLights WordPress plugin up to and including 1.4 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as a contributor to perform Stored Cross-Site Scripting att...

Codelights-shortcodes-and-widgets Project Codelights-shortcodes-and-widgets

The Sidebar Widgets by CodeLights plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘Extra CSS class’ parameter in versions up to, and including, 1.4 due to insufficient input sanitization and output escaping. This makes it possible for authent...

Codelights-shortcodes-and-widgets Project Codelights-shortcodes-and-widgets

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission.

Navigate Project Navigate -

1 2 NEXT »

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook