CVE-2021-42233

The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting XSS vulnerability. When any user opens a particular blog hosted on an attackers' site, XSS may occur...

m1k1o's Blog 1.3 Remote Code Execution

Exploit Title: m1k1o's Blog v.10 - Remote Code Execution RCE Authenticated Date: 2022-01-06 Exploit Author: Malte V Vendor Homepage: https://github.com/m1k1o/blog Software Link: https://github.com/m1k1o/blog/archive/refs/tags/v1.3.zip Version: 1.3 and below Tested on: Linux CVE : CVE-2022-23626...

CVE-2021-42233: Improper Neutralization of Input During Web Page Generation

The Simple Blog plugin in Wondercms 3.4.1 is vulnerable to stored cross-site scripting XSS vulnerability. When any user opens a particular blog hosted on an attackers' site, XSS may occur...

PT-2022-11575

Name of the Vulnerable Software and Affected Versions Wondercms version 3.4.1 Description The Simple Blog plugin in Wondercms is vulnerable to a stored cross-site scripting XSS issue. This occurs when a user opens a particular blog hosted on an attacker's site, potentially leading to XSS...

Wondercms Plugin Simple Blog Cross-Site Script Vulnerability

WonderCMS is a cms. version 3.4.1 of WonderCMS contains a cross-site scripting vulnerability that can be exploited by attackers to cause XSS to occur when any user opens a specific blog hosted on their website...

Threat Source newsletter (May 19, 2022) — Why I'm missing the days of iPods and LimeWire

By Jon Munshaw. Welcome to this week’s edition of the Threat Source newsletter. I will openly admit that I still own a “classic” iPod — the giant brick that weighed down my skinny jeans in high school and did nothing except play music. There are dozens of hours of music on there that I... This is...

GHSA-46VM-RWRF-JRXM CSRF in baserCMS 3.0.10 and earlier

Cross-site request forgery CSRF vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

CSRF in baserCMS 3.0.10 and earlier

Cross-site request forgery CSRF vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote attackers to hijack the authentication of administrators via unspecified vectors...

GHSA-MXFV-C8P8-QW5H baserCMS Cross-site Scripting vulnerability

Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

baserCMS Cross-site Scripting vulnerability

Cross-site scripting vulnerability in baserCMS plugin Blog version 3.0.10 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors...

Trend Micro's One Vision, One Platform

Why Trend Micro is evolving its approach to enterprise protection...

EC-CUBE Easy Blog for EC-CUBE4 Cross-Site Request Forgery Vulnerability

EC-CUBE Easy Blog for EC-CUBE4 is a component of the content management system from EC-CUBE Japan. EC-CUBE Easy Blog for EC-CUBE4 1.0.1 and earlier versions are vulnerable to cross-site request forgery, which stems from insufficient authentication of the source of HTTP requests. A remote,...

Fake Mobile Apps Steal Facebook Credentials, Cryptocurrency-Related Keys

We recently observed a number of apps on Google Play designed to perform malicious activities such as stealing user credentials and other sensitive user information, including private keys...

GHSA-H7VH-6GMM-G7H9 Stored XSS in LavaLite 5.2.4

LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code...

Stored XSS in LavaLite 5.2.4

LavaLite version 5.2.4 is vulnerable to stored cross-site scripting vulnerability, within the blog creation page, which can result in disruption of service and execution of javascript code...

Gleez CMS Stored XSS

Cross-site scripting XSS vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers users to inject JavaScript via HTML content in an editor, which will result in Stored XSS when an Administrator tries to edit the same content, as demonstrated by use of the source editor for HTML mode ...

GHSA-M2R2-QC49-GQW4 Gleez CMS Stored XSS

Cross-site scripting XSS vulnerability in Gleez CMS 1.2.0 and 2.0 might allow remote attackers users to inject JavaScript via HTML content in an editor, which will result in Stored XSS when an Administrator tries to edit the same content, as demonstrated by use of the source editor for HTML mode ...

angular-lunarc-blog (>=0.0.1, <=0.0.3), angular-lunarc-core (>=0.0.2, <=0.0.5) +15 more potentially affected by CVE-2018-11537 via angular-jwt (>=0.0.7, <=0.1.9)

angular-jwt NPM version =0.0.7, =0.0.1, =0.0.2, =0.0.1, =4.0.0, =1.0.0, =2.0.0, =4.0.0, =3.0.19, =3.1.0, =7.0.0, =3.0.0, =1.0.0-alpha.6, =0.2.4, =0.0.1, =0.5.0 and more Source cves: CVE-2018-11537 Source advisory: GHSA-VM2P-F5J4-MJ6G...

Subrion Cross-site scripting (XSS) vulnerability

Cross-site scripting XSS vulnerability in Subrion CMS allows remote attackers to inject arbitrary web script or HTML via the body to blog/add/, a different vulnerability than CVE-2017-6069...

GHSA-WRRJ-R2J4-969W Umbraco CMS vulnerable to stored XSS

Persistent cross-site scripting XSS vulnerability in Umbraco CMS 7.12.3 allows authenticated users to inject arbitrary web script via the Header Name of a content Blog, Content Page, etc.. The vulnerability is exploited when updating or removing public access of a content...