rainbutterfly/cve_corpus huggingface dataset:
CVE-2021-24497 Giveaway <= 1.2.2 - Authenticated SQL Injection
The Giveaway WordPress plugin through 1.2.2 is vulnerable to an SQL Injection issue which allows an administrative user to execute arbitrary SQL commands via the $post_id on the options.php page.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Giveaway
Credits: lang: en
value: Mesut Cetin
Published: 2021-08-23T11:09:57.000Z
CVE-2021-24498 Calendar Event Multi View < 1.4.01 - Unauthenticated Reflected Cross-Site Scripting (XSS)
The Calendar Event Multi View WordPress plugin before 1.4.01 does not sanitise or escape the 'start' and 'end' GET parameters before outputting them in the page (via php/edit.php), leading to a reflected Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Calendar Event Multi View
Credits: lang: en
value: iohex
Published: 2021-08-02T10:32:28.000Z
CVE-2021-24499 Workreap theme < 2.2.2 - Unauthenticated Upload Leading to Remote Code Execution
The Workreap WordPress theme before 2.2.2 AJAX actions workreap_award_temp_file_uploader and workreap_temp_file_uploader did not perform nonce checks, or validate that the request is from a valid user in any other way. The endpoints allowed for uploading arbitrary files to the uploads/workreap-temp directory. Uploaded files were neither sanitized nor validated, allowing an unauthenticated visitor to upload executable code such as php scripts.
Problem types: cwe_id: CWE-434
description: CWE-434 Unrestricted Upload of File with Dangerous Type
Affected products: vendor: Unknown
product: Workreap
Credits: lang: en
value: Harald Eilertsen (Jetpack)
Published: 2021-08-09T00:00:00.000Z
CVE-2021-24500 Workreap theme < 2.2.2 - Multiple CSRF + IDOR Vulnerabilities
Several AJAX actions available in the Workreap WordPress theme before 2.2.2 lacked CSRF protections, as well as allowing insecure direct object references that were not validated. This allows an attacker to trick a logged in user to submit a POST request to the vulnerable site, potentially modifying or deleting arbitrary objects on the target site.
Problem types: cwe_id: CWE-283
description: CWE-283 Unverified Ownership
cwe_id: CWE-284
description: CWE-284 Improper Access Control
cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Workreap
Credits: lang: en
value: Harald Eilertsen (Jetpack)
Published: 2021-08-09T10:04:08.000Z
CVE-2021-24501 Workreap theme < 2.2.2 - Missing Authorization Checks in Ajax Actions
The Workreap WordPress theme before 2.2.2 had several AJAX actions missing authorization checks to verify that a user was authorized to perform critical operations such as modifying or deleting objects. This allowed a logged in user to modify or delete objects belonging to other users on the site.
Problem types: cwe_id: CWE-283
description: CWE-283 Unverified Ownership
cwe_id: CWE-862
description: CWE-862 Missing Authorization
Affected products: vendor: Unknown
product: Workreap
Credits: lang: en
value: Harald Eilertsen (Jetpack)
Published: 2021-08-09T10:04:09.000Z
CVE-2021-24502 WP Google Map < 1.7.7 - Authenticated Stored Cross-Site Scripting (XSS)
The WP Google Map WordPress plugin before 1.7.7 did not sanitise or escape the Map Title before outputting them in the page, leading to a Stored Cross-Site Scripting issue by high privilege users, even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Maps Plugin using Google Maps for WordPress – WP Google Map
Credits: lang: en
value: Pratik Khalane
Published: 2021-08-09T10:04:10.000Z
CVE-2021-24503 Popular Brand SVG Icons - Simple Icons < 2.7.8 - Contributor+ Stored XSS
The Popular Brand Icons – Simple Icons WordPress plugin before 2.7.8 does not sanitise or validate some of its shortcode parameters, such as "color", "size" or "class", allowing users with a role as low as Contributor to set Cross-Site payload in them. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Popular Brand Icons – Simple Icons
Credits: lang: en
value: apple502j
Published: 2021-08-02T10:32:29.000Z
CVE-2021-24504 WP LMS <= 1.1.2 - Stored Cross-Site Scripting (XSS)
The WP LMS – Best WordPress LMS Plugin WordPress plugin through 1.1.2 does not properly sanitise or validate its User Field Titles, allowing XSS payload to be used in them. Furthermore, no CSRF and capability checks were in place, allowing such attack to be performed either via CSRF or as any user (including unauthenticated)
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: WP LMS – Best WordPress LMS Plugin
Credits: lang: en
value: Mohammed Adam
Published: 2021-08-02T10:32:30.000Z
CVE-2021-24505 Forms  < 1.12.3 - Authenticated Stored Cross-Site Scripting (XSS)
The Forms WordPress plugin before 1.12.3 did not sanitise its input fields, leading to Stored Cross-Site scripting issues. The plugin was vulnerable to an Authenticated Stored Cross-Site Scripting (XSS) vulnerability within the Forms "Add new" field.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Forms
Credits: lang: en
value: SHUBHANGI DAWKHAR
Published: 2021-08-09T10:04:11.000Z
CVE-2021-24506 Slider Hero < 8.2.7 - Contributor+ SQL Injection
The Slider Hero with Animation, Video Background & Intro Maker WordPress plugin before 8.2.7 does not sanitise or escape the id attribute of its hero-button shortcode before using it in a SQL statement, allowing users with a role as low as Contributor to perform SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Slider Hero with Animation, Video Background & Intro Maker
Credits: lang: en
value: apple502j
Published: 2021-08-23T11:09:58.000Z
CVE-2021-24507 Astra Pro Addon < 3.5.2 - Unauthenticated SQL Injection
The Astra Pro Addon WordPress plugin before 3.5.2 did not properly sanitise or escape some of the POST parameters from the astra_pagination_infinite and astra_shop_pagination_infinite AJAX action (available to both unauthenticated and authenticated user) before using them in SQL statement, leading to an SQL Injection issues
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Astra Pro Addon
Credits: lang: en
value: Ngoc Nguyen
Published: 2021-08-09T10:04:12.000Z
CVE-2021-24508 Smash Balloon Social Post Feed < 2.19.2 - Unauthenticated Stored XSS
The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feed_locator AJAX action (available to both authenticated and unauthenticated users) before outputting a truncated version of it in the admin dashboard, leading to an unauthenticated Stored Cross-Site Scripting issue which will be executed in the context of a logged in administrator.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Smash Balloon Social Post Feed
Credits: lang: en
value: dc11
Published: 2021-09-13T17:56:20.000Z
CVE-2021-24509 Page View Counts < 2.4.9 - Contributor+ Stored XSS
The Page View Count WordPress plugin before 2.4.9 does not escape the postid parameter of pvc_stats shortcode, allowing users with a role as low as Contributor to perform Stored XSS attacks. A post made by a contributor would still have to be approved by an admin to have the XSS triggered in the frontend, however, higher privilege users, such as editor could exploit this without the need of approval, and even when the blog disallows the unfiltered_html capability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Page View Count
Credits: lang: en
value: apple502j
Published: 2021-08-09T10:04:13.000Z
CVE-2021-24510 MF Gig Calendar < 1.2 - Reflected Cross-Site Scripting (XSS)
The MF Gig Calendar WordPress plugin before 1.2 does not sanitise and escape the id GET parameter before outputting back in the admin dashboard when editing an Event, leading to a reflected Cross-Site Scripting issue
Problem types: description: CWE-79 Cross-Site Scripting (XSS)
Affected products: vendor: Unknown
product: MF Gig Calendar
default_status: unaffected
Credits: lang: en
value: iohex
lang: en
value: WPScan
Published: 2021-09-13T17:56:22.000Z
CVE-2021-24511 Create WooCommerce Product Feeds For 40+ Merchants < 3.3.1.0 - Authenticated SQL Injection
The fetch_product_ajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a `product_id` POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Product Feed on WooCommerce for Google, Awin, Shareasale, Bing, and More
Credits: lang: en
value: Syed Sheeraz Ali of Codevigilant
Published: 2021-09-20T10:06:13.000Z
CVE-2021-24512 Video Posts Webcam Recorder < 3.2.4 - Authenticated Reflected XSS
The Video Posts Webcam Recorder WordPress plugin before 3.2.4 has an authenticated reflected cross site scripting (XSS) vulnerability in one of the administrative functions for handling deletion of videos.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Video Posts Webcam Recorder
Credits: lang: en
value: iohex
Published: 2021-08-16T10:48:23.000Z
CVE-2021-24513 Form Builder < 1.9.8.4 - Authenticated Stored Cross-Site Scripting
The Form Builder | Create Responsive Contact Forms WordPress plugin before 1.9.8.4 does not sanitise or escape its Form Title, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Form Builder | Create Responsive Contact Forms
Credits: lang: en
value: Felipe Restrepo Rodriguez
Published: 2021-09-06T11:09:25.000Z
CVE-2021-24514 Visual Form Builder < 3.0.4 - Admin+ Stored Cross-Site Scripting
The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Visual Form Builder
Credits: lang: en
value: Felipe Restrepo Rodriguez
Published: 2021-10-25T13:20:39.000Z
CVE-2021-24515 Video Gallery - Vimeo and YouTube Gallery < 1.1.5 - Admin+ Stored Cross-Site Scripting
The Video Gallery WordPress plugin before 1.1.5 does not escape the Title and Description of the videos in a gallery before outputting them in attributes, leading to Stored Cross-Site Scripting issues
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Video Gallery - Vimeo and YouTube Gallery
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-10-25T13:20:41.000Z
CVE-2021-24516 PlanSo Forms <= 2.6.3 - Authenticated Stored Cross-Site Scripting
The PlanSo Forms WordPress plugin through 2.6.3 does not escape the title of its Form before outputting it in attributes, allowing high privilege users such as admin to set XSS payload in it, even when the unfiltered_html is disallowed, leading to an Authenticated Stored Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: PlanSo Forms
Credits: lang: en
value: Felipe Restrepo Rodriguez
Published: 2021-10-18T13:45:43.000Z
CVE-2021-24517 Stop Spammers Security < 2021.18 - Authenticated Stored XSS
The Stop Spammers Security | Block Spam Users, Comments, Forms WordPress plugin before 2021.18 does not escape some of its settings, allowing high privilege users such as admin to set Cross-Site Scripting payloads in them even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Stop Spammers Security | Block Spam Users, Comments, Forms
Credits: lang: en
value: swapnil subhash bodekar
Published: 2021-09-06T11:09:26.000Z
CVE-2021-24518 WPFront Notification Bar < 2.0.0.07176 - Authenticated Stored XSS
The WPFront Notification Bar WordPress plugin before 2.0.0.07176 does not sanitise or escape its Custom CSS setting, allowing high privilege users such as admin to set XSS payload in it even when the unfiltered_html capability is disallowed, leading to an authenticated Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WPFront Notification Bar
Credits: lang: en
value: swapnil subhash bodekar
Published: 2021-08-16T10:48:24.000Z
CVE-2021-24519 Vik Rent Car < 1.1.10 - Authenticated Stored Cross-Site Scripting (XSS)
The VikRentCar Car Rental Management System WordPress plugin before 1.1.10 does not sanitise the 'Text Next to Icon' field when adding or editing a Characteristic, allowing high privilege users such as admin to use XSS payload in it, leading to an authenticated Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: VikRentCar Car Rental Management System
Credits: lang: en
value: Muhammad Daffa
Published: 2021-08-16T10:48:25.000Z
CVE-2021-24520 Stock in & out <= 1.0.4 - Authenticated SQL Injection
The Stock in & out WordPress plugin through 1.0.4 lacks proper sanitization before passing variables to an SQL request, making it vulnerable to SQL Injection attacks. Users with a role of contributor or higher can exploit this vulnerability.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Stock in & out
Credits: lang: en
value: pang0lin
Published: 2021-08-09T10:04:14.000Z
CVE-2021-24521 Side Menu Lite < 2.2.1 - Authenticated SQL Injection
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack.
Problem types: cwe_id: CWE-89
description: CWE-89 SQL Injection
Affected products: vendor: Unknown
product: Side Menu Lite – add sticky fixed buttons
Credits: lang: en
value: pang0lin @webray.com.cn inc
Published: 2021-08-09T10:04:14.000Z
CVE-2021-24522 ProfilePress < 3.1.11 - Unauthenticated Cross-Site Scripting (XSS) in tabbed login/register widget
The User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar) WordPress plugin before 3.1.11's widget for tabbed login/register was not properly escaped and could be used in an XSS attack which could lead to wp-admin access. Further, the plugin in several places assigned $_POST as $_GET which meant that in some cases this could be replicated with just $_GET parameters and no need for $_POST values.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: User Registration, User Profile, Login & Membership – ProfilePress (Formerly WP User Avatar)
Credits: lang: en
value: Stiofan
Published: 2021-08-09T10:04:15.000Z
CVE-2021-24523 Daily Prayer Time < 2021.08.10 - Authenticated Stored XSS
The Daily Prayer Time WordPress plugin before 2021.08.10 does not sanitise or escape some of its settings before outputting them in the page, leading to Authenticated Stored Cross-Site Scripting issues.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Daily Prayer Time
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-09-13T17:56:24.000Z
CVE-2021-24524 GiveWP < 2.12.0 - Authenticated Stored XSS
The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.12.0 did not escape the Donation Level setting of its Donation Forms, allowing high privilege users to use Cross-Site Scripting payloads in them.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: GiveWP – Donation Plugin and Fundraising Platform
Credits: lang: en
value: Asif Nawaz Minhas
Published: 2021-08-23T11:09:59.000Z
CVE-2021-24525 Shortcodes Ultimate < 5.10.2 - Contributor+ Stored XSS
The Shortcodes Ultimate WordPress plugin before 5.10.2 allows users with Contributor roles to perform stored XSS via shortcode attributes. Note: the plugin is inconsistent in its handling of shortcode attributes; some do escape, most don't, and there are even some attributes that are insecure by design (like [su_button]'s onclick attribute).
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: WordPress Shortcodes Plugin — Shortcodes Ultimate
Credits: lang: en
value: apple502j
Published: 2021-09-20T10:06:15.000Z
CVE-2021-24526 Form Maker < 1.13.60 - Authenticated Stored XSS
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin before 1.13.60 does not escape its Form Title before outputting it in an attribute when editing a form in the admin dashboard, leading to an authenticated Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder
Credits: lang: en
value: Felipe Restrepo Rodriguez
Published: 2021-08-16T10:48:26.000Z
CVE-2021-24527 Profile Builder < 3.4.9 - Admin Access via Password Reset
The User Registration & User Profile – Profile Builder WordPress plugin before 3.4.9 has a bug allowing any user to reset the password of the admin of the blog, and gain unauthorised access, due to a bypass in the way the reset key is checked. Furthermore, the admin will not be notified of such change by email for example.
Problem types: cwe_id: CWE-287
description: CWE-287 Improper Authentication
Affected products: vendor: Unknown
product: User Registration & User Profile – Profile Builder
Credits: lang: en
value: Stiofan
Published: 2021-08-16T10:48:27.000Z
CVE-2021-24528 FluentSMTP < 2.0.1 - Authenticated Stored XSS
The FluentSMTP WordPress plugin before 2.0.1 does not sanitize parameters before storing the settings in the database, nor does the plugin escape the values before outputting them when viewing the SMTP settings set by this plugin, leading to a stored cross site scripting (XSS) vulnerability. Only users with roles capable of managing plugins can modify the plugin's settings.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: FluentSMTP – WordPress Mail SMTP, SES, SendGrid, Mailgun and Any SMTP Plugin
Credits: lang: en
value: YoshiKen
Published: 2021-08-30T14:11:20.000Z
CVE-2021-24529 Grid Gallery < 1.2.5 - Authenticated Stored Cross Site Scripting (XSS)
The Grid Gallery – Photo Image Grid Gallery WordPress plugin before 1.2.5 does not properly sanitize the title field for image galleries when adding them via the admin dashboard, resulting in an authenticated Stored Cross-Site Scripting vulnerability.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Grid Gallery – Photo Image Grid Gallery
Credits: lang: en
value: Amal E Thamban
Published: 2021-08-23T11:10:00.000Z
CVE-2021-24530 Alojapro Widget <= 1.1.15 - Authenticated Stored Cross-Site Scripting (XSS)
The Alojapro Widget WordPress plugin through 1.1.15 doesn't properly sanitise its Custom CSS settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Alojapro Widget
Credits: lang: en
value: xiahao
Published: 2021-09-20T10:06:17.000Z
CVE-2021-24531 Charitable – Donation Plugin < 1.6.51 - Authenticated Stored Cross-Site Scripting (XSS)
The Charitable – Donation Plugin WordPress plugin before 1.6.51 is affected by an authenticated stored cross-site scripting vulnerability which was found in the add donation feature.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Charitable – Donation Plugin
Credits: lang: en
value: Muhammad Daffa
Published: 2021-08-23T11:10:00.000Z
CVE-2021-24533 Maintenance < 4.03 - Authenticated Stored XSS
The Maintenance WordPress plugin before 4.03 does not sanitise or escape some of its settings, allowing high privilege users such as admin to se Cross-Site Scripting payload in them (even when the unfiltered_html capability is disallowed), which will be triggered in the frontend
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: Maintenance
Credits: lang: en
value: Emil kylander
Published: 2021-08-23T11:10:01.000Z
CVE-2021-24534 PhoneTrack Meu Site Manager <= 0.1 - Authenticated Stored XSS
The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "php_id" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
Affected products: vendor: Unknown
product: PhoneTrack Meu Site Manager
Credits: lang: en
value: ABISHEIK M
Published: 2021-08-16T10:48:28.000Z
CVE-2021-24535 Light Messages <= 1.0 - CSRF to Stored XSS
The Light Messages WordPress plugin through 1.0 is lacking CSRF check when updating it's settings, and is not sanitising its Message Content in them (even with the unfiltered_html disallowed). As a result, an attacker could make a logged in admin update the settings to arbitrary values, and set a Cross-Site Scripting payload in the Message Content. Depending on the options set, the XSS payload can be triggered either in the backend only (in the plugin's settings), or both frontend and backend.
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Light Messages
Credits: lang: en
value: Vinay Bhuria
Published: 2021-08-16T10:48:29.000Z
CVE-2021-24536 Custom Login Redirect <= 1.0.0 - CSRF to Stored XSS
The Custom Login Redirect WordPress plugin through 1.0.0 does not have CSRF check in place when saving its settings, and do not sanitise or escape user input before outputting them back in the page, leading to a Stored Cross-Site Scripting issue
Problem types: cwe_id: CWE-79
description: CWE-79 Cross-site Scripting (XSS)
cwe_id: CWE-352
description: CWE-352 Cross-Site Request Forgery (CSRF)
Affected products: vendor: Unknown
product: Custom Login Redirect
Credits: lang: en
value: Vinay Bhuria
Published: 2021-08-16T10:48:30.000Z