CVE-2023-40669

CVE-2023-40669 affects the WordPress Collapse-O-Matic plugin (plugin slug jquery-collapse-o-matic) with vulnerable versions reported as <= 1.8.5.5 (and related entries reference 1.8.5.8 as affected by PatchStack). The vulnerability is described as an Authenticated (Contributor+) Stored Cross-S...

Collapse-O-Matic <= 1.8.5.5 - Contributor+ Stored XSS

Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks As a Contributor user create a new post and add a shortcode containing the following payload: expand elwraptag="img...

Collapse-O-Matic <= 1.8.5.5 - Contributor+ Stored XSS

Description The plugin does not validate and escape some parameters, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks PoC As a Contributor user create a new post and add a shortcode containing the following payload: expand elwraptag="img...

PT-2023-27589

Name of the Vulnerable Software and Affected Versions twinpictures, baden03 Collapse-O-Matic plugin versions = 1.8.5.5 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This vulnerability can be exploited by contributors or users with higher privileges. The...

CVE-2023-40669: Improper Neutralization of Input During Web Page Generation

Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in twinpictures, baden03 Collapse-O-Matic plugin = 1.8.5.5 versions...

WordPress plugin Collapse-O-Matic cross-site scripting vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...

UK Air Traffic Control System Collapses, Causing Travel Chaos

By Waqas Hundreds of Thousands of Passengers Face Travel Chaos as UK Air Traffic Control System Collapses. This is a post from HackRead.com Read the original post: UK Air Traffic Control System Collapses, Causing Travel Chaos...

WordPress Collapse-O-Matic Plugin <= 1.8.5.8 is vulnerable to Cross Site Scripting (XSS)

Software Collapse-O-Matic Type Plugin Vulnerable versions = 1.8.5.8 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-40669 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 0a5a524f2b8f Credits Rafshanzani Suhada...

Class-Action Lawsuit for Scraping Data without Permission

I have mixed feelings about this class-action lawsuit against OpenAI and Microsoft, claiming that it "scraped 300 billion words from the internet" without either registering as a data broker or obtaining consent. On the one hand, I want this to be a protected fair use of public data. On the other...

2 Russians charged in Mt. Gox Bitcoin heist and BTC-e money laundering

By Habiba Rashid Accused individuals allegedly conspired to launder around 647,000 stolen Bitcoins from Mt. Gox, leading to its collapse. This is a post from HackRead.com Read the original post: 2 Russians charged in Mt. Gox Bitcoin heist and BTC-e money laundering...

Bay Area Bank Collapse and the Cybersecurity Impact

Greg Young, VP of Cybersecurity and CorpDev, discusses what the second-largest bank collapse in U.S. history means for cybersecurity...

bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

bootstrap: Cross-site Scripting (XSS) in the collapse data-parent attribute

In Bootstrap before 4.1.2, XSS is possible in the collapse data-parent attribute...

CVE-2022-4829 Show-Hide / Collapse-Expand < 1.3.0 - Contributor+ Stored XSS via Shortcode

The Show-Hide / Collapse-Expand WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against...

WordPress plugin Show-Hide / Collapse-Expand 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

CVE-2022-4829: Undefined Security Weakness

The Show-Hide / Collapse-Expand WordPress plugin before 1.3.0 does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against...

PT-2023-15668

Name of the Vulnerable Software and Affected Versions Show-Hide / Collapse-Expand WordPress plugin versions prior to 1.3.0 Description The issue allows users with a role as low as contributor to perform Stored Cross-Site Scripting attacks, which could be used against high privilege users such as...

SUSE CVE-2012-1972

Use-after-free vulnerability in the nsHTMLEditor::CollapseAdjacentTextNodes function in Mozilla Firefox before 15.0, Firefox ESR 10.x before 10.0.7, Thunderbird before 15.0, Thunderbird ESR 10.x before 10.0.7, and SeaMonkey before 2.12 allows remote attackers to execute arbitrary code or cause a...