rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24537 Similar Posts <= 3.1.5 - Admin+ Arbitrary PHP Code Execution
The Similar Posts WordPress plugin through 3.1.5 allow high privilege users to execute arbitrary PHP code in an hardened environment (ie with DISALLOW_FILE_EDIT, DISALLOW_FILE_MODS and DISALLOW_UNFILTERED_HTML set to true) via the 'widget_rrm_similar_posts_condition' widget setting of the plugin.
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: Similar Posts – Best Related Posts Plugin for WordPress
Credits: lang: en
value: bl4derunner
Published: 2021-11-08T17:34:43.000Z
CVE-2021-24538 Current Book <= 1.0.1 - Authenticated Stored Cross-Site Scripting (XSS)
The Current Book WordPress plugin through 1.0.1 does not sanitize user input when an authenticated user adds Author or Book Title, then does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Current Book
Credits: lang: en
value: Vikas Srivastava
Published: 2021-08-16T10:48:31.000Z
CVE-2021-24539 Coming Soon, Under Construction & Maintenance Mode By Dazzler < 1.6.7 - Admin+ Stored Cross-Site Scripting
The Coming Soon, Under Construction & Maintenance Mode By Dazzler WordPress plugin before 1.6.7 does not sanitise or escape its description setting when outputting it in the frontend when the Coming Soon mode is enabled, even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Coming Soon, Under Construction & Maintenance Mode By Dazzler
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-11-01T08:45:58.000Z
CVE-2021-24540 Wonder Video Embed < 1.8 - Contributor+ Stored XSS
The Wonder Video Embed WordPress plugin before 1.8 does not escape parameters of its wonderplugin_video shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Wonder Video Embed
Credits: lang: en
value: apple502j
Published: 2021-08-16T10:48:31.000Z
CVE-2021-24541 Wonder PDF Embed < 1.7 - Contributor+ Stored XSS
The Wonder PDF Embed WordPress plugin before 1.7 does not escape parameters of its wonderplugin_pdf shortcode, which could allow users with a role as low as Contributor to perform Stored XSS attacks.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Wonder PDF Embed
Credits: lang: en
value: apple502j
Published: 2021-08-16T10:48:32.000Z
CVE-2021-24543 jQuery Reply to Comment <= 1.31 - CSRF to Stored Cross-Site Scripting
The jQuery Reply to Comment WordPress plugin through 1.31 does not have any CSRF check when saving its settings, nor sanitise or escape its 'Quote String' and 'Reply String' settings before outputting them in Comments, leading to a Stored Cross-Site Scripting issue.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: jQuery Reply to Comment
Credits: lang: en
value: Prashant Karman Patel
Published: 2021-10-25T13:20:42.000Z
CVE-2021-24544 Responsive WordPress Slider <= 2.2.0 - Subscriber+ Stored Cross-Site Scripting
The Responsive WordPress Slider WordPress plugin through 2.2.0 does not sanitise and escape some of the Slider options, allowing Cross-Site Scripting payloads to be set in them. Furthermore, as by default any authenticated user is allowed to create Sliders (https://wordpress.org/support/topic/slider-can-be-changed-from-any-user-even-subscriber/, such settings can be changed in the plugin's settings), this would allow user with a role as low as subscriber to perform Cross-Site Scripting attacks against logged in admins viewing the slider list and could lead to privilege escalation by creating a rogue admin account for example.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Responsive WordPress Slider
Credits: lang: en
value: Abhiyan Chheri . Veshraj Ghimire
Published: 2021-10-25T13:20:44.000Z
CVE-2021-24545 WP HTML Author Bio <= 1.2.0 - Author+ Stored Cross-Site Scripting
The WP HTML Author Bio WordPress plugin through 1.2.0 does not sanitise the HTML allowed in the Bio of users, allowing them to use malicious JavaScript code, which will be executed when anyone visit a post in the frontend made by such user. As a result, user with a role as low as author could perform Cross-Site Scripting attacks against users, which could potentially lead to privilege escalation when an admin view the related post/s.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP HTML Author Bio
Credits: lang: en
value: Veshraj Ghimire
Published: 2021-10-11T10:45:27.000Z
CVE-2021-24546 EditorsKit < 1.31.6 - Contributor+ Arbitrary PHP Code Execution
The Gutenberg Block Editor Toolkit – EditorsKit WordPress plugin before 1.31.6 does not sanitise and validate the Conditional Logic of the Custom Visibility settings, allowing users with a role as low contributor to execute Arbitrary PHP code
Problem types: cwe_id: CWE-94
description: CWE-94 Improper Control of Generation of Code ('Code Injection')
Affected products: vendor: Unknown
product: Gutenberg Block Editor Toolkit – EditorsKit
Credits: lang: en
value: bl4derunner
Published: 2021-10-11T10:45:29.000Z
CVE-2021-24547 KN Fix Your Title <= 1.0.1 - Authenticated Stored XSS
The KN Fix Your Title WordPress plugin through 1.0.1 was vulnerable to Authenticated Stored XSS in the separator field.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: KN Fix Your Title
Credits: lang: en
value: Aakash Choudhary
Published: 2021-08-23T11:10:02.000Z
CVE-2021-24548 Mimetic Books <= 0.2.13 - Authenticated Stored Cross-Site Scripting (XSS)
The Mimetic Books WordPress plugin through 0.2.13 was vulnerable to Authenticated Stored Cross-Site Scripting (XSS) in the "Default Publisher ID" field on the plugin's settings page.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Mimetic Books
Credits: lang: en
value: Vikas Srivastava
Published: 2021-08-16T10:48:33.000Z
CVE-2021-24549 AceIDE <= 2.6.2 - Authenticated (admin+) Arbitrary File Access
The AceIDE WordPress plugin through 2.6.2 does not sanitise or validate the user input which is appended to system paths before using it in various actions, such as to read arbitrary files from the server. This allows high privilege users such as administrator to access any file on the web server outside of the blog directory via a path traversal attack.
Problem types: cwe_id: CWE-22
description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: AceIDE
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-08-23T11:10:03.000Z
CVE-2021-24550 Broken Link Manager <= 0.6.5 - Authenticated (admin+) SQL Injection
The Broken Link Manager WordPress plugin through 0.6.5 does not sanitise, validate or escape the url GET parameter before using it in a SQL statement when retrieving an URL to edit, leading to an authenticated SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Broken Link Manager
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-08-23T11:10:04.000Z
CVE-2021-24551 Edit Comments <= 0.3 - Unauthenticated SQL Injection
The Edit Comments WordPress plugin through 0.3 does not sanitise, validate or escape the jal_edit_comments GET parameter before using it in a SQL statement, leading to a SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Edit Comments
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-08-23T11:10:06.000Z
CVE-2021-24552 Simple Events Calendar <= 1.4.0 - Authenticated (admin+) SQL Injection
The Simple Events Calendar WordPress plugin through 1.4.0 does not sanitise, validate or escape the event_id POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Simple Events Calendar
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-08-23T11:10:07.000Z
CVE-2021-24553 Timeline Calendar <= 1.2 - Authenticated (admin+) SQL Injection
The Timeline Calendar WordPress plugin through 1.2 does not sanitise, validate or escape the edit GET parameter before using it in a SQL statement when editing events, leading to an authenticated SQL injection issue. Other SQL Injections are also present in the plugin
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Timeline Calendar
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-08-23T11:10:08.000Z
CVE-2021-24554 Paytm - Donation Plugin <= 1.3.2 - Authenticated (admin+) SQL Injection
The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Paytm – Donation Plugin
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-08-23T11:10:09.000Z
CVE-2021-24555 Diary & Availability Calendar <= 1.0.3 - Authenticated (subscriber+) SQL Injection
The daac_delete_booking_callback function, hooked to the daac_delete_booking AJAX action, takes the id POST parameter which is passed into the SQL statement without proper sanitisation, validation or escaping, leading to a SQL Injection issue. Furthermore, the ajax action is lacking any CSRF and capability check, making it available to any authenticated user.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Diary & Availability Calendar
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-08-23T11:10:09.000Z
CVE-2021-24556 Email Subscriber <= 1.1 - Unauthenticated Stored Cross-Site Scripting (XSS)
The kento_email_subscriber_ajax AJAX action of the Email Subscriber WordPress plugin through 1.1, does not properly sanitise, validate and escape the submitted subscribe_email and subscribe_name POST parameters, inserting them in the DB and then outputting them back in the Subscriber list (/wp-admin/edit.php?post_type=kes_campaign&page=kento_email_subscriber_list_settings), leading a Stored XSS issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Email Subscriber
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-08-23T11:10:10.000Z
CVE-2021-24557 M-vSlider <= 2.1.3 - Authenticated (admin+) SQL Injection
The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: M-vSlider
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-08-23T11:10:11.000Z
CVE-2021-24558 Project Status <= 1.6 - Reflected Cross-Site Scripting (XSS)
The pspin_duplicate_post_save_as_new_post function of the Project Status WordPress plugin through 1.6 does not sanitise, validate or escape the post GET parameter passed to it before outputting it in an error message when the related post does not exist, leading to a reflected XSS issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Project Status
Credits: lang: en
value: Shreya Pohekar of Codevigilant Project
Published: 2021-08-23T11:10:12.000Z
CVE-2021-24559 Qyrr < 0.7 - Authenticated (contributor+) Stored XSS
The Qyrr WordPress plugin before 0.7 does not escape the data-uri of the QR Code when outputting it in a src attribute, allowing for Cross-Site Scripting attacks. Furthermore, the data_uri_to_meta AJAX action, available to all authenticated users, only had a CSRF check in place, with the nonce available to users with a role as low as Contributor allowing any user with such role (and above) to set a malicious data-uri in arbitrary QR Code posts, leading to a Stored Cross-Site Scripting issue.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Qyrr
default_status: unaffected
Credits: lang: en
value: dc11
lang: en
value: WPScan
Published: 2024-01-16T15:48:44.511Z
CVE-2021-24560 Software License Manager < 4.4.8 - Reflected Cross-Site Scripting
The Software License Manager WordPress plugin before 4.4.8 does not sanitise or escape the edit_record parameter before outputting it back in the page in the admin dashboard, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Software License Manager
Credits: lang: en
value: iohex
Published: 2021-09-13T17:56:25.000Z
CVE-2021-24561 WP SMS < 5.4.13 - Authenticated Stored Cross-Site Scripting
The WP SMS WordPress plugin before 5.4.13 does not sanitise the "wp_group_name" parameter before outputting it back in the "Groups" page, leading to an Authenticated Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WP SMS
Credits: lang: en
value: Muhammad Daffa
Published: 2021-08-23T11:10:13.000Z
CVE-2021-24562 LifterLMS < 4.21.2 - Access Other Student Grades/Answers via IDOR
The LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress plugin before 4.21.2 was affected by an IDOR issue, allowing students to see other student answers and grades
Problem types: cwe_id: CWE-639
description: CWE-639 Authorization Bypass Through User-Controlled Key
Affected products: vendor: Unknown
product: LMS by LifterLMS – Online Course, Membership & Learning Management System Plugin for WordPress
Credits: lang: en
value: Amirmuhammad vakili
Published: 2021-08-23T11:10:14.000Z
CVE-2021-24563 Frontend Uploader <= 1.3.2 - Unauthenticated Stored Cross-Site Scripting
The Frontend Uploader WordPress plugin through 1.3.2 does not prevent HTML files from being uploaded via its form, allowing unauthenticated user to upload a malicious HTML file containing JavaScript for example, which will be triggered when someone access the file directly
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Frontend Uploader
Credits: lang: en
value: Veshraj Ghimire
Published: 2021-10-11T10:45:30.000Z
CVE-2021-24564 WPFront Scroll Top < 2.0.6.07225 - Authenticated Stored XSS
The WPFront Scroll Top WordPress plugin before 2.0.6.07225 does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WPFront Scroll Top
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-08-23T11:10:15.000Z
CVE-2021-24565 Contact Form 7 Captcha < 0.0.9 - CSRF to Stored XSS
The Contact Form 7 Captcha WordPress plugin before 0.0.9 does not have any CSRF check in place when saving its settings, allowing attacker to make a logged in user with the manage_options change them. Furthermore, the settings are not escaped when output in attributes, leading to a Stored Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Contact Form 7 Captcha
Credits: lang: en
value: dc11
Published: 2021-08-23T11:10:16.000Z
CVE-2021-24566 WooCommerce Currency Switcher < 1.3.7 - Authenticated (Low Privilege) Local File Inclusion
The WooCommerce Currency Switcher FOX WordPress plugin before 1.3.7 was vulnerable to LFI attacks via the "woocs" shortcode.
Problem types: description: CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
Affected products: vendor: Unknown
product: FOX
default_status: unaffected
Credits: lang: en
value: Marc Montpas (Jetpack Scan)
lang: en
value: WPScan
Published: 2024-01-16T15:48:44.185Z
CVE-2021-24567 Simple Post <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS)
The Simple Post WordPress plugin through 1.1 does not sanitize user input when an authenticated user Text value, then it does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue.
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Post
default_status: affected
Credits: lang: en
value: Vikas Srivastava
lang: en
value: WPScan
Published: 2024-01-16T15:48:43.806Z
CVE-2021-24568 AddToAny < 1.7.46 - Authenticated Stored XSS
The AddToAny Share Buttons WordPress plugin before 1.7.46 does not sanitise its Sharing Header setting when outputting it in frontend pages, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: AddToAny Share Buttons
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-09-06T11:09:27.000Z
CVE-2021-24569 Cookie Notice & Compliance for GDPR / CCPA < 2.1.2 - Admin+ Stored Cross-Site Scripting
The Cookie Notice & Compliance for GDPR / CCPA WordPress plugin before 2.1.2 does not escape the value of its Button Text setting when outputting it in an attribute in the frontend, allowing high privilege users such as admin to perform Cross-Site Scripting even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Cookie Notice & Compliance for GDPR / CCPA
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-09-27T15:25:21.000Z
CVE-2021-24570 Paypal Donation < 1.3.1 - CSRF to Stored Cross-Site Scripting
The Accept Donations with PayPal WordPress plugin before 1.3.1 offers a function to create donation buttons, which internally are posts. The process to create a new button is lacking a CSRF check. An attacker could use this to make an authenticated admin create a new button. Furthermore, one of the Button field is not escaped before being output in an attribute when editing a Button, leading to a Stored Cross-Site Scripting issue as well.
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Accept Donations with PayPal
Credits: lang: en
value: dc11
Published: 2021-11-01T08:46:00.000Z
CVE-2021-24571 HD Quiz < 1.8.4 - Authenticated Stored XSS
The HD Quiz WordPress plugin before 1.8.4 does not escape some of its Answers before outputting them in attribute when generating the Quiz, which could lead to Stored Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: HD Quiz
Credits: lang: en
value: Authenticated Stored XSS
Published: 2021-08-23T11:10:17.000Z
CVE-2021-24572 Paypal Donation < 1.3.1 - CSRF to Arbitrary Post Deletion
The Accept Donations with PayPal WordPress plugin before 1.3.1 provides a function to create donation buttons which are internally stored as posts. The deletion of a button is not CSRF protected and there is no control to check if the deleted post was a button post. As a result, an attacker could make logged in admins delete arbitrary posts
Problem types: cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Accept Donations with PayPal
Credits: lang: en
value: dc11
Published: 2021-11-01T08:46:01.000Z
CVE-2021-24574 Simple Banner < 2.10.4 - Authenticated Stored XSS
The Simple Banner WordPress plugin before 2.10.4 does not sanitise and escape one of its settings, allowing high privilege users such as admin to use Cross-Site Scripting payload even when the unfiltered_html capability is disallowed.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Simple Banner
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-08-23T11:10:18.000Z
CVE-2021-24575 WPSchoolPress < 2.1.10 - Multiple Authenticated SQL Injections
The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to teachers and above.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: School Management System – WPSchoolPress
Credits: lang: en
value: JrXnm
Published: 2021-11-08T17:34:44.000Z
CVE-2021-24576 Easy Accordion < 2.0.22 - Authenticated Stored XSS
The Easy Accordion WordPress plugin before 2.0.22 does not properly sanitize inputs when adding new items to an accordion.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Easy Accordion – Best Accordion FAQ Plugin for WordPress
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-10-11T10:45:31.000Z
CVE-2021-24577 Coming Soon and Maintenance Mode < 3.5.3 - Authenticated Stored XSS
The Coming soon and Maintenance mode WordPress plugin before 3.5.3 does not properly sanitize inputs submitted by authenticated users when setting adding or modifying coming soon or maintenance mode pages, leading to stored XSS.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Coming soon and Maintenance mode
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-10-11T10:45:33.000Z
CVE-2021-24578 SportsPress < 2.7.9 - Reflected Cross-Site Scripting
The SportsPress WordPress plugin before 2.7.9 does not sanitise and escape its match_day parameter before outputting back in the Events backend page, leading to a Reflected Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: SportsPress – Sports Club & League Manager
Credits: lang: en
value: iohex
Published: 2021-12-21T08:45:25.000Z