10Web Social Post Feed < 1.1.27 - Authenticated SQL Injection

Authenticated SQL injection in the 10Web Social Post Feed WordPress Plugin 1.1.26 via the /wordpress/wp-admin/admin.php?page=infoffwd searchvalue parameter. PoC https://drive.google.com/file/d/1Hndhdy3leYTzutx-DJvu1B-tW5Y5teBB/view...

WordPress 10Web Social Post Feed plugin <= 1.1.26 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Vu Tien Hoa SunCSR in WordPress 10Web Social Post Feed plugin versions = 1.1.26. Solution Update the WordPress 10Web Social Post Feed plugin to the latest available version at least 1.1.27...

10Web Social Post Feed < 1.1.27 - Authenticated SQL Injection

Authenticated SQL injection in the 10Web Social Post Feed WordPress Plugin 1.1.26 via the /wordpress/wp-admin/admin.php?page=infoffwd searchvalue parameter. https://drive.google.com/file/d/1Hndhdy3leYTzutx-DJvu1B-tW5Y5teBB/view...

Cross-Site Scripting in console-feed

Versions of console-feed prior to 2.8.10 are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape the rendered output. If an application uses console-feed and a malicious JavaScript payload was passed to a console.log'%', payload call, the package would render HTML...

GHSA-G9WG-WQ4F-2X5W Cross-Site Scripting in console-feed

Versions of console-feed prior to 2.8.10 are vulnerable to Cross-Site Scripting XSS. The package fails to properly escape the rendered output. If an application uses console-feed and a malicious JavaScript payload was passed to a console.log'%', payload call, the package would render HTML...

Squid proxy CRLF Injection

The vulnerability of the Squid proxy server is related to the failure to handle CRLF sequences in HTTP headers. Exploiting this vulnerability allows a remote attacker to inject arbitrary HTTP headers...

PT-2020-21305

Name of the Vulnerable Software and Affected Versions console-feed versions prior to 2.8.10 Description The issue arises from the package's failure to properly escape the rendered output, leading to a potential Cross-Site Scripting XSS attack. If a malicious JavaScript payload is passed to a...

Puma HTTP Server XSS

The vulnerability of HTTP servers for Ruby/Rack applications developed with Puma is related to the improper elimination of characters CR, LF, /r, and /n before data is entered into the HTTP headers. Exploiting this vulnerability allows a remote attacker to perform cross-site scripting attacks...

CVE-2020-23974

Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Messagetitle-tag, Add new client all-tags...

CVE-2020-23974

Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Messagetitle-tag, Add new client all-tags...

Cross site scripting

Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Messagetitle-tag, Add new client all-tags...

CVE-2020-23974

Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Messagetitle-tag, Add new client all-tags...

CVE-2020-23974

CVE-2020-23974 affects Create-Project Manager 1.07. The issue is described as Multi Persistent Cross-site Scripting and HTML injection via UI surfaces such as Online chat, Social feed, Message(title-tag), and Add new client (all-tags). The provided documents do not specify the root cause details,...

CVE-2020-8218

creationtimestamp| type| source ---|---|--- 2020-08-27 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=506 2020-08-29 11:05:49+00:00| published-proof-of-concept| https://t.me/cKure/2007 2020-08-29 11:29:34+00:00| published-proof-of-concept|...

CVE-2020-23974: Improper Neutralization of Input During Web Page Generation

Create-Project Manager 1.07 has Multi Persistent Cross-site Scripting and HTML injection in via Online chat, Social feed,Messagetitle-tag, Add new client all-tags...

PT-2020-6755

Name of the Vulnerable Software and Affected Versions Create-Project Manager version 1.07 Description The issue concerns a lack of protection in the web page structure, allowing for potential exploitation. This can lead to a remote attacker conducting a cross-site scripting XSS attack. The...

CVE-2020-24314

Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...

CVE-2020-24314

Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...

Cross site scripting

Fahad Mahmood RSS Feed Widget Plugin v2.7.9 and lower does not sanitize the value of the "t" GET parameter before echoing it back out inside an input tag. This results in a reflected XSS vulnerability that attackers can exploit with a specially crafted URL...

CVE-2020-24314

Affected software: Fahad Mahmood RSS Feed Widget Plugin for WordPress, v2.7.9 and earlier. Vulnerability: Reflected XSS via the GET parameter "t" that is echoed into an input tag without sanitization. Impact: Attackers can craft a URL to trigger XSS (no exploitation details beyond this). Exploita...