Show filters
53 Total Results
Displaying 21-30 of 53
Sort by:
Attacker Value
Unknown
CVE-2020-20402
Disclosure Date: January 31, 2023 (last updated October 08, 2023)
Westbrookadmin portfolioCMS v1.05 allows attackers to bypass password validation and access sensitive information via session fixation.
0
Attacker Value
Unknown
CVE-2022-2597
Disclosure Date: September 05, 2022 (last updated February 24, 2025)
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST endpoints, allowing users with a role as low as contributor to call them and inject arbitrary CSS in arbitrary saved layouts
0
Attacker Value
Unknown
CVE-2022-2543
Disclosure Date: September 05, 2022 (last updated February 24, 2025)
The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.18.0 does not have proper authorisation checks in some of its REST endpoints, allowing unauthenticated users to call them and inject arbitrary CSS in arbitrary saved layouts
0
Attacker Value
Unknown
CVE-2022-25613
Disclosure Date: April 04, 2022 (last updated February 23, 2025)
Authenticated Persistent Cross-Site Scripting (XSS) vulnerability in FV Flowplayer Video Player (WordPress plugin) versions <= 7.5.18.727 via &fv_wp_flowplayer_field_splash parameter.
0
Attacker Value
Unknown
CVE-2022-25607
Disclosure Date: March 18, 2022 (last updated February 23, 2025)
Authenticated (author or higher user role) SQL Injection (SQLi) vulnerability discovered in FV Flowplayer Video Player WordPress plugin (versions <= 7.5.15.727).
0
Attacker Value
Unknown
CVE-2021-39350
Disclosure Date: October 05, 2021 (last updated February 23, 2025)
The FV Flowplayer Video Player WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the player_id parameter found in the ~/view/stats.php file which allows attackers to inject arbitrary web scripts, in versions 7.5.0.727 - 7.5.2.727.
0
Attacker Value
Unknown
CVE-2021-34649
Disclosure Date: August 13, 2021 (last updated February 23, 2025)
The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the `dark` parameter in the ~/titan-framework/iframe-font-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.2.
0
Attacker Value
Unknown
CVE-2020-35748
Disclosure Date: January 15, 2021 (last updated February 22, 2025)
Cross-site scripting (XSS) vulnerability in models/list-table.php in the FV Flowplayer Video Player plugin before 7.4.37.727 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the fv_wp_fvvideoplayer_src JSON field in the data parameter.
0
Attacker Value
Unknown
CVE-2015-9487
Disclosure Date: October 11, 2019 (last updated November 27, 2024)
The ThemeMakers Almera Responsive Portfolio theme through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
0
Attacker Value
Unknown
CVE-2015-9488
Disclosure Date: October 11, 2019 (last updated November 27, 2024)
The ThemeMakers Almera Responsive Portfolio Site Template component through 2015-05-15 for WordPress allows remote attackers to obtain sensitive information (such as user_login, user_pass, and user_email values) via a direct request for the wp-content/uploads/tmm_db_migrate/wp_users.dat URI.
0
