Advisories · Technology
sc0ttkclark Pods – Custom Content Types and Fields.
Every CVE that names sc0ttkclark Pods – Custom Content Types and Fields among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.4 Medium
Pods <= 3.3.9.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'not_found' Shortcode Attribute
- sc0ttkclark Pods – Custom Content Types and Fields
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Pods <= 3.3.9 - Unauthenticated Privilege Escalation via Authorization Bypass to Admin Methods via 'pods_admin' AJAX Router
- sc0ttkclark Pods – Custom Content Types and Fields
- Broken access control
- CVSS 5.4 Medium
Pods – Custom Content Types and Fields <= 3.2.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via Pod Form Redirect URL
- sc0ttkclark Pods – Custom Content Types and Fields
- Cross-site scripting (XSS)
- CVSS 8.8 High
Pods - Custom Content Types and Fields - Authenticated (Contributor+) Remote Code Execution
- sc0ttkclark Pods – Custom Content Types and Fields
- Command injection
- CVSS 4.3 Medium
Pods - Custom Content Types and Fields - Missing Authorization
- sc0ttkclark Pods – Custom Content Types and Fields
- Broken access control
- CVSS 8.8 High
Pods - Custom Content Types and Fields - Authenticated (Contributor+) SQL Injection via Shortcode
- sc0ttkclark Pods – Custom Content Types and Fields
- SQL injection