CVE-2020-28455

This affects all versions of package markdown-it-toc. The title of the generated toc and the contents of the header are not escaped.

Source: CVE-2020-28455

CVE-2020-28435

This affects all versions of package ffmpeg-sdk. The injection point is located in line 9 in index.js.

Source: CVE-2020-28435

CVE-2020-28422

All versions of package git-archive are vulnerable to Command Injection via the exports function.

Source: CVE-2020-28422

CVE-2022-2240

The Request a Quote WordPress plugin through 2.3.7 does not validate uploaded CSV files, allowing unauthenticated users to attach a malicious CSV file to a quote, which could lead to a CSV injection once an admin download and open it

Source: CVE-2022-2240

CVE-2022-2115

The Popup Anything WordPress plugin before 2.1.7 does not sanitise and escape a parameter before outputting it back in a frontend page, leading to a Reflected Cross-Site Scripting

Source: CVE-2022-2115

CVE-2022-0899

The Header Footer Code Manager WordPress plugin before 1.1.24 does not escape generated URLs before outputting them back in attributes in an admin page, leading to a Reflected Cross-Site Scripting.

Source: CVE-2022-0899

CVE-2022-1539

The Exports and Reports WordPress plugin before 0.9.2 does not sanitize and validate data when generating the CSV to export, which could lead to a CSV injection, by the use of Microsoft Excel DDE function, or to leak data via maliciously injected hyperlinks.

Source: CVE-2022-1539

CVE-2022-2071

The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them.

Source: CVE-2022-2071

CVE-2022-1551

The SP Project & Document Manager WordPress plugin through 4.57 uses an easily guessable path to store user files, bad actors could use that to access other users’ sensitive files.

Source: CVE-2022-1551

CVE-2022-2341

The Simple Page Transition WordPress plugin through 1.4.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfiltered_html capability is disallowed (for example in multisite setup)

Source: CVE-2022-2341