CVE-2021-24413

Vulnerability: CVE-2021-24413 affects the WordPress Easy Twitter Feed plugin (versions

CVE-2021-24413: Improper Neutralization of Input During Web Page Generation

The Easy Twitter Feed WordPress plugin before 1.2 does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode...

PT-2021-15946

Name of the Vulnerable Software and Affected Versions Easy Twitter Feed WordPress plugin versions prior to 1.2 Description The issue allows users with a role as low as contributor to set Cross-Site Scripting payload in the parameters from the shortcode, which will be triggered in the pages with t...

WordPress plugin cross-site scripting vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...

DEBIAN-CVE-2021-41136

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a...

CVE-2021-30883

creationtimestamp| type| source ---|---|--- 2021-10-12 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=670 2021-10-12 04:46:19+00:00| exploited| https://t.me/thehackernews/1576 2021-10-12 10:09:20+00:00| exploited| https://t.me/truesecator/2203 2021-10-12 11:36:49+00:00|...

WordPress Smash Balloon Social Post Feed Plugin < 2.19.2 XSS Vulnerability

The WordPress plugin Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...

CVE-2021-31988

A user controlled parameter related to SMTP test functionality is not correctly validated making it possible to add the Carriage Return and Line Feed CRLF control characters and include arbitrary SMTP headers in the generated test email...

PT-2021-19617 · Axis Communications +1 · Axis Os +3

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: The issue is related to a user-controlled parameter in the SMTP test functionality that is not correctly validated. This allows an attacker to add...

Axis Os injection vulnerability

Axis Os is an edge device operating system from Axis of Sweden. An injection vulnerability exists in Axis devices AXIS OS version 5.51 and later versions, which stems from a failure to properly validate a control parameter related to the SMTP test function, and as a result, it is possible to add...

WordPress WPeMatico RSS Feed Fetcher plugin <= 2.6.11 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Huy Nguyen in WordPress WPeMatico RSS Feed Fetcher plugin versions = 2.6.11. Solution Update the WordPress Connections Business Directory plugin to the latest available version...

WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting

The plugin does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. PoC Create/edit a campaign and add the following feed URL:...

WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting

The plugin does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Create/edit a campaign and add the following feed URL:...

CVE-2021-24511

The fetchproductajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24511

The fetchproductajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

Sql injection

The fetchproductajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24511

The fetchproductajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

PT-2021-16033

Name of the Vulnerable Software and Affected Versions WooCommerce WordPress plugin versions prior to 3.3.1.0 Description The issue arises from the fetch product ajax functionality in the Product Feed, where the product id POST parameter is not properly sanitised, escaped, or validated before bein...

WordPress Easy Twitter Feed plugin <= 1.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Michał Lipiński in WordPress Easy Twitter Feed plugin versions = 1.1. Solution Update the WordPress Easy Twitter Feed plugin to the latest available version at least 1.2...

Easy Twitter Feed < 1.2 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode PoC Log in as contributor and add the following shortco...