CVE-2022-0969

Image optimization & Lazy Load < 3.3.2 - Admin+ Stored Cross-Site Scripting

The Image optimization & Lazy Load by Optimole WordPress plugin before 3.3.2 does not sanitise and escape its "Lazyload background images for selectors" settings, which could allow high privilege users such as admin to perform Cross-Site scripting attacks even when the unfiltered_html capability is disallowed.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Vertistudio

Products

Image Optimization \& Lazy Load By Optimole

CVE-2022-0968

The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in microweber/microweber

The microweber application allows large characters to insert in the input field "fist & last name" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber in GitHub repository microweber/microweber prior to 1.2.12.

CVSS 3.1 · 5.5 Medium EPSS 3.7% KEV · Not listed

Vendors

Microweber

Products

Microweber

CVE-2022-0967

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in star7th/showdoc

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS 3.3% KEV · Not listed

Vendors

Showdoc

Products

Showdoc

CVE-2022-0966

Stored XSS via File Upload in star7th/showdoc in star7th/showdoc

Stored XSS via File Upload in star7th/showdoc in GitHub repository star7th/showdoc prior to 2.4.10.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Showdoc

Products

Showdoc

CVE-2022-0965

Stored XSS viva .ofd file upload in star7th/showdoc

Stored XSS viva .ofd file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Showdoc

Products

Showdoc

CVE-2022-0964

Stored XSS viva .webmv file upload in star7th/showdoc

Stored XSS viva .webmv file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Showdoc

Products

Showdoc

CVE-2022-0963

Unrestricted XML Files Leads to Stored XSS in microweber/microweber

Unrestricted XML Files Leads to Stored XSS in GitHub repository microweber/microweber prior to 1.2.12.

CVSS 3.1 · 5.4 Medium EPSS 1.9% KEV · Not listed

Vendors

Microweber

Products

Microweber

CVE-2022-0962

Stored XSS viva .webma file upload in star7th/showdoc

Stored XSS viva .webma file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Showdoc

Products

Showdoc

CVE-2022-0961

The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in microweber/microweber

The microweber application allows large characters to insert in the input field "post title" which can allow attackers to cause a Denial of Service (DoS) via a crafted HTTP request. in GitHub repository microweber/microweber prior to 1.2.12.

CVSS 3.1 · 5.5 Medium EPSS 1.0% KEV · Not listed

Vendors

Microweber

Products

Microweber

CVE-2022-0960

Stored XSS viva .properties file upload in star7th/showdoc

Stored XSS viva .properties file upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Showdoc

Products

Showdoc

CVE-2022-0958

Mark Posts < 2.0.1 - Admin+ Stored Cross-Site Scripting

The Mark Posts WordPress plugin before 2.0.1 does not escape new markers, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Mark Posts Project

Products

Mark Posts

CVE-2022-0957

Stored XSS via File Upload in star7th/showdoc

Stored XSS via File Upload in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Showdoc

Products

Showdoc

CVE-2022-0956

Stored XSS via File Upload in star7th/showdoc

Stored XSS via File Upload in GitHub repository star7th/showdoc prior to v.2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Showdoc

Products

Showdoc

CVE-2022-0955

Cross-site Scripting (XSS) - Stored in pimcore/data-hub

Cross-site Scripting (XSS) - Stored in GitHub repository pimcore/data-hub prior to 1.2.4.

CVSS 3.1 · 4.8 Medium EPSS < 1% KEV · Not listed

Vendors

Pimcore

Products

Data-hub

CVE-2022-0954

Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in microweber/microweber

Multiple Stored Cross-site Scripting (XSS) Vulnerabilities in Shop's Other Settings, Shop's Autorespond E-mail Settings and Shops' Payments Methods in GitHub repository microweber/microweber prior to 1.2.11.

CVSS 3.1 · 5.4 Medium EPSS 3.2% KEV · Not listed

Vendors

Microweber

Products

Microweber

CVE-2022-0953

Anti-Malware Security and Brute-Force Firewall < 4.20.96 - Reflected Cross-Site Scripting

The Anti-Malware Security and Brute-Force Firewall WordPress plugin before 4.20.96 does not sanitise and escape the QUERY_STRING before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting in browsers which do not encode characters

CVSS 3.1 · 6.1 Medium EPSS 3.1% KEV · Not listed

Vendors

Download Anti-malware Security And Brute-force Firewall Project

Products

Download Anti-malware Security And Brute-force Firewall

CVE-2022-0952

Sitemap by click5 < 1.0.36 - Unauthenticated Arbitrary Options Update

The Sitemap by click5 WordPress plugin before 1.0.36 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the plugin. As a result, unauthenticated attackers could change arbitrary blog options, such as the users_can_register and default_role, allowing them to create a new admin account and take over the blog.

CVSS 3.1 · 8.8 High EPSS 11.4% KEV · Not listed

Vendors

Sitemap Project

Products

Sitemap

CVE-2022-0951

File Upload Restriction Bypass leading to Stored XSS Vulnerability in star7th/showdoc

File Upload Restriction Bypass leading to Stored XSS Vulnerability in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 6.1 Medium EPSS < 1% KEV · Not listed

Vendors

Showdoc

Products

Showdoc

CVE-2022-0950

Unrestricted Upload of File with Dangerous Type in star7th/showdoc

Unrestricted Upload of File with Dangerous Type in GitHub repository star7th/showdoc prior to 2.10.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed

Vendors

Showdoc

Products

Showdoc

CVE-2022-0949

WP Block and Stop Bad Bots < 6.930 - Unauthenticated SQLi

The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 6.930 does not properly sanitise and escape the fingerprint parameter before using it in a SQL statement via the stopbadbots_grava_fingerprint AJAX action, available to unauthenticated users, leading to a SQL injection

CVSS 3.1 · 9.8 Critical EPSS 7.7% KEV · Not listed

Vendors

Stopbadbots

Products

Block And Stop Bad Bots