WordPress Smash Balloon Custom Facebook Feed plugin <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via data-color Attribute vulnerability discovered by Asaf Mozes in WordPress Plugin Smash Balloon Social Post Feed versions = 4.3.1...

CVE-2025-4577

creationtimestamp| type| source ---|---|--- 2025-06-10 11:34:12+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/17868...

CVE-2025-4577

The CVE entry CVE-2025-4577 concerns the Smash Balloon Social Post Feed (Custom Facebook Feed) WordPress plugin. Connected sources confirm a Stored Cross-Site Scripting (XSS) vulnerability via the data-color attribute in all versions up to and including 4.3.1, caused by insufficient input sanitiz...

CVE-2025-4577 Smash Balloon Custom Facebook Feed <= 4.3.1 - Authenticated (Contributor+) Stored Cross-Site Scripting via `data-color` Attribute

The Smash Balloon Social Post Feed – Simple Social Feeds for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the data-color attribute in all versions up to, and including, 4.3.1 due to insufficient input sanitization and output escaping. This makes it possible for...

Exploit for OS Command Injection in Php

CVE-2024-4577 취약점 테스트 스크립트 이 Python 스크립트는 PHP의 최신 취약점인 CVE-...

CVE-2022-4577

The Easy Testimonials WordPress plugin before 3.9.3 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high...

Exploit for OS Command Injection in Php

CVE-2024-4577 Exploit Exploit of the PHP CGI Argument Injectio...

Exploit for OS Command Injection in Php

CVE-2024-4577 usage: CVE-2024-4577.py -h -v RHOST RPO...

Exploit for OS Command Injection in Php

This is POC of CVE 2024-4577 This exploit allows attac...

Exploit for OS Command Injection in Php

PHP-CGI Injector 🚀 CVE-2024-4577 & CVE-2024-8926 Exploit To...

PHP on Windows 8.1.x < 8.1.29 / 8.2.x < 8.2.20 / 8.3.x < 8.3.8 Arbitrary Code Execution (CVE-2024-4577)

The version of PHP: Hypertext Preprocessor detected on the remote Windows host is 8.1.x prior to 8.1.29, 8.2.x prior to 8.2.20, or 8.3.x prior to 8.3.8. It is, therefore, affected by an arbitrary code execution vulnerability: - In PHP versions 8.1. before 8.1.29, 8.2. before 8.2.20, 8.3. before...

CVE-2010-4577

creationtimestamp| type| source ---|---|--- 2025-01-21 18:00:50+00:00| seen| https://t.me/DarkWebInformerCVEAlerts/2438...

Slackware: Security Advisory (SSA:2024-297-01)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

[slackware-security] php81

New php81 packages are available for Slackware 15.0 to fix security issues. Here are the details from the Slackware 15.0 ChangeLog: extra/php81/php81-8.1.30-i586-1slack15.0.txz: Upgraded. This update fixes bugs and security issues: Bypass of CVE-2024-4577, Parameter Injection Vulnerability...

Slackware Linux 15.0 php81 Multiple Vulnerabilities (SSA:2024-297-01)

The version of php81 installed on the remote host is prior to 8.1.30. It is, therefore, affected by multiple vulnerabilities as referenced in the SSA:2024-297-01 advisory. New php81 packages are available for Slackware 15.0 to fix security issues. Tenable has extracted the preceding description...

BIT-PHP-2024-8926 PHP CGI Parameter Injection Vulnerability (CVE-2024-4577 bypass)

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows...

CVE-2024-8926

In PHP versions 8.1. before 8.1.30, 8.2. before 8.2.24, 8.3. before 8.3.12, when using a certain non-standard configurations of Windows codepages, the fixes for CVE-2024-4577 https://github.com/advisories/GHSA-vxpp-6299-mxw3 may still be bypassed and the same command injection related to Windows...

Exploit for OS Command Injection in Php

CVE-2024-4577 Vulnerability Checker The CVE-2024-4577 Vulnera...

Fedora: Security Advisory (FEDORA-2024-7c800c4df7)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

PHP 8.3.x < 8.3.12 Multiple Vulnerabilities

According to its self-reported version number, the version of PHP installed on the remote host is 8.1.x prior to 8.1.30, 8.2.x prior to 8.2.24, or 8.3.x prior to 8.3.12. It is, therefore, affected by multiple vulnerabilities: - Parameter injection vulnerability with a bypass of CVE-2024-4577...