The Clasify Classified Listing WordPress plugin through 1.0.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin.
oryginał ENCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:NSmartdatasoft Clasify Classified Listing
APPSmartdatasoft≤ 1.0.7
Powiązane podatności
Multiple SQL injection vulnerabilities in SmartDataSoft SmartBlog for PrestaShop before 4.06 allow a remote un...
SmartBlog 2.0.1 contains a blind SQL injection vulnerability in the 'id_post' parameter of the details control...
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in SmartDat...
The Essential WP Real Estate WordPress plugin through 1.1.3 does not escape generated URLs before outputting t...
The Essential WP Real Estate plugin for WordPress is vulnerable to unauthorized access due to a missing capabi...