金迪邮件系统 邮件正文 存储型XSS漏洞

0x01漏洞简介 JDMAIL金迪邮件系统在邮件正文处存在存储型的XSS漏洞。 0x02漏洞详情 xss漏洞一：邮件正文测试代码： 漏洞二打印预览 0x03修复方案 取消对html5标签embed的支持。...

Pornhub: XSS ReflectedGET /*embed_player*?

The researcher discovered a reflected XSS in the embedplayer route...

WordPress Plugin Advanced Video 1.0 - Local File Inclusion

WordPress Plugin Advanced Video 1.0 - Local File Inclusion !/usr/bin/env python Exploit Title: Advanced-Video-Embed Arbitrary File Download / Unauthenticated Post Creation Google Dork: N/A Date: 04/01/2016 Exploit Author: evait security GmbH Vendor Homepage: arshmultani - http://dscom.it/ Softwar...

Template Injection

Overview Affected versions of jsrender are susceptible to a remote code execution vulnerability when used with server delivered client-side tempates which dynamically embed user input. Proof of Concept for x!=1?constructor.constructor"return arguments.callee.caller":y10 :data /for function...

authorstream.com XSS vulnerability

Vulnerable URL: http://www.authorstream.com/Action/pdfEmbedPage.aspx?pid=2743727635915443481107500==alert/XSSPOSED/...

SS-2015-027: HtmlEditor embed url sanitisation

More info at https://www.silverstripe.org/download/security-releases/ss-2015-027/...

CVE-2015-6535: Stored XSS in YouTube Embed (WordPress plugin) allows admins to compromise super admins

Details ================ Software: YouTube Embed Version: 3.3.2 Homepage: https://wordpress.org/plugins/youtube-embed/ CVE ID: CVE-2015-6535 Pending CWE ID: CWE-79 CVSS: 5.5 Medium; AV:N/AC:L/Au:S/C:P/I:P/A:N Description ================ A stored XSS vulnerability in YouTube Embed 3.3.2 and...

WordPress YouTube Embed Plugin Cross-Site Scripting Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation. A cross-site scripting vulnerability exists in the includes/options-profiles.php script in WordPress YouTube Embed plugin versions prior to 3.3.3. The vulnerability can be exploited by ...

CVE-2015-6535

Cross-site scripting XSS vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field youtubeembedname parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field youtubeembedname parameter...

CVE-2015-6535

Cross-site scripting XSS vulnerability in includes/options-profiles.php in the YouTube Embed plugin before 3.3.3 for WordPress allows remote administrators to inject arbitrary web script or HTML via the Profile name field youtubeembedname parameter...

CVE-2015-6535

This CVE concerns WordPress YouTube Embed plugin (software: YouTube Embed; version 3.3.2, potentially earlier) with a stored XSS in includes/options-profiles.php. The vulnerability arises from unsanitized input in the Profile name field (youtube_embed_name parameter), allowing an admin user to in...

WordPress YouTube Embed 3.3.2 Cross Site Scripting Vulnerability

WordPress YouTube Embed plugin version 3.3.2 suffers from a stored cross site scripting vulnerability. Details ================ Software: YouTube Embed Version: 3.3.2 Homepage: https://wordpress.org/plugins/youtube-embed/ CVE ID: CVE-2015-6535 Pending CWE ID: CWE-79 CVSS: 5.5 Medium;...

WordPress YouTube Embed 3.3.2 Cross Site Scripting

Details ================ Software: YouTube Embed Version: 3.3.2 Homepage: https://wordpress.org/plugins/youtube-embed/ CVE ID: CVE-2015-6535 Pending CWE ID: CWE-79 CVSS: 5.5 Medium; AV:N/AC:L/Au:S/C:P/I:P/A:N Description ================ A stored XSS vulnerability in YouTube Embed 3.3.2 and...

Shopify - Persistent Embed POST Inject Vulnerability

Document Title: =============== Shopify - Persistent Embed POST Inject Vulnerability References: =========== http://www.vulnerability-lab.com/getcontent.php?id=1556 Video View: https://www.youtube.com/watch?v=5qiJ4UjJtQ Release Date: ============= 2015-08-13 Vulnerability Laboratory ID VL-ID:...

WordPress XVE Various Embed Plugin <= 1.0.3 - Cross Site Scripting

This plugin is prone to JW player multiple cross site scripting vulnerabilities. Solution Update the plugin...

WordPress XVE Various Embed Plugin <= 1.0.3 - Cross Site Scripting

This plugin is prone to JW player multiple cross site scripting vulnerabilities. Solution Update the plugin...

WordPress Embed Plus Plugin <= 5.3 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

WordPress plugin Embed-Articles/wp-admin/admin.php cross-site request forgery vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin Embed-Articles/wp-admin/admin.php, which allows a...

WordPress Embed Articles Plugin <= 7.0.3 - Multiple Vulnerabilities

This plugin is prone to a cross site scripting and cross site request forgery vulnerabilities. Attackers can insert arbitrary script into admin page, hijack admin's cookies etc. Solution This plugin is closed...