PT-2024-14503

Name of the Vulnerable Software and Affected Versions YzmCMS versions 6.5 through 7.0 Description The issue allows for XSS via the Referer HTTP header in the member/index/register.html page. Recommendations For YzmCMS versions 6.5 through 7.0, consider restricting access to the...

VulnCheck KEV: CVE-2020-13167

Netsweeper through 6.4.3 allows unauthenticated remote code execution because webadmin/tools/unixlogin.php with certain Referer headers launches a command line with client-supplied parameters, and allows injection of shell metacharacters...

CVE-2023-6527

The Email Subscription Popup plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the HTTPREFERER header in all versions up to, and including, 1.2.18 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject...

PT-2023-32688 · WordPress · Email Subscription Popup

Name of the Vulnerable Software and Affected Versions: Email Subscription Popup plugin for WordPress versions up to, and including, 1.2.18 Description: The issue is related to Reflected Cross-Site Scripting via the HTTP REFERER header due to insufficient input sanitization and output escaping. Th...

CE Phoenix 1.0.8.20 Remote Code Execution Exploit

Exploit Title: CE Phoenix v1.0.8.20 - Remote Code Execution RCE Authenticated Date: 2023-11-25 Exploit Author: tmrswrr Category: Webapps Vendor Homepage: CE Phoenix Version: v1.0.8.20 Tested on: Softaculous Demo - CE Phoenix EXPLOIT : import requests from bs4 import BeautifulSoup import sys impor...

satellite: Blind SSRF via Referer header

A blind site-to-site request forgery vulnerability was found in Satellite server. It is possible to trigger an external interaction to an attacker's server by modifying the Referer header in an HTTP request of specific resources in the server...

Nature Easy Soft Network Technology ZenTao Cross-Site Request Forgery Vulnerability

Nature Easy Soft Network Technology ZenTao is China's easy soft Tianchuang network technology Nature Easy Soft Network Technology company's open source project management software. The software includes product management, project management, quality management and document management and other...

Cross-site Scripting (XSS)

Overview github.com/greenpau/caddy-security is a Security App and Plugin for Caddy v2. Affected versions of this package are vulnerable to Cross-site Scripting XSS via the Referer header, due to improper input sanitization. Although the Referer header is sanitized by escaping some characters that...

CVE-2023-4294

The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link...

CVE-2023-4294: Undefined Security Weakness

The URL Shortify WordPress plugin before 1.7.6 does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link...

CVE-2023-32497

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Supersoju Block Referer Spam plugin = 1.1.9.4 versions...

CVE-2023-32497

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Supersoju Block Referer Spam plugin = 1.1.9.4 versions...

Cross site scripting

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Supersoju Block Referer Spam plugin = 1.1.9.4 versions...

CVE-2023-32497 WordPress Block Referer Spam Plugin <= 1.1.9.4 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Supersoju Block Referer Spam plugin = 1.1.9.4 versions...

CVE-2023-32497

CVE-2023-32497 is a Stored XSS vulnerability in the WordPress plugin Block Referer Spam (Supersoju) that affects versions

WordPress plugin Block Referer Spam 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

PT-2023-23831 · WordPress · Supersoju Block Referer Spam

Name of the Vulnerable Software and Affected Versions: Supersoju Block Referer Spam plugin versions 1.1.9.4 and earlier Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability that requires authentication with admin+ privileges. This vulnerability affects the Supersoj...

CVE-2023-32497: Improper Neutralization of Input During Web Page Generation

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Supersoju Block Referer Spam plugin = 1.1.9.4 versions...

URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header

Description The plugin does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link. 1. Add a new shortened link in the interface...

URL Shortify < 1.7.6 - Unauthenticated Stored XSS via referer header

Description The plugin does not properly escape the value of the referer header, thus allowing an unauthenticated attacker to inject malicious javascript that will trigger in the plugins admin panel with statistics of the created short link. PoC 1. Add a new shortened link in the interface...