4947 matches found
CVE-2020-35489
Summary (CVE-2020-35489): The WordPress plugin Contact Form 7 (before 5.3.2) is vulnerable to an unrestricted file upload leading to remote code execution because a filename can contain special characters. Affected product: WordPress Contact Form 7 plugin; affected version range: prior to 5.3.2. ...
CVE-2020-35489
The contact-form-7 aka Contact Form 7 plugin before 5.3.2 for WordPress allows Unrestricted File Upload and remote code execution because a filename may contain special characters...
PT-2020-6885 · WordPress · Contact Form 7
Name of the Vulnerable Software and Affected Versions: Contact Form 7 versions prior to 5.3.2 Description: The issue is related to an Unrestricted File Upload vulnerability in the Contact Form 7 plugin for WordPress, which can lead to remote code execution. This is because a filename may contain...
Wordpress contact-form-7 代码问题漏洞
Wordpress contact-form-7 is a Wordpress Foundation plugin that provides forms for Wordpress. A security vulnerability exists in contact-form-7 aka Contact Form 7 plugin prior to version 5.3.2 that allows unrestricted file uploads and remote code execution because file names may contain special...
Contact Form 7 < 5.3.2 - Unrestricted File Upload
The popular WordPress plugin, Contact Form 7 was found to be vulnerable to Unrestricted File Upload. PoC Append a unicode special character from U+0000 null to U+001F us to a filename and upload it via the ContactForm7 upload feature...
WordPress Contact Form 7 plugin <= 5.3.1 - Unrestricted File Upload vulnerability
Unrestricted File Upload vulnerability found by Jinson Varghese Behanan in WordPress Contact Form 7 plugin versions = 5.3.1. Solution Update the WordPress Contact Form 7 plugin to the latest available version at least 5.3.2...
Contact Form 7 < 5.3.2 - Unrestricted File Upload
The popular WordPress plugin, Contact Form 7 was found to be vulnerable to Unrestricted File Upload. Append a unicode special character from U+0000 null to U+001F us to a filename and upload it via the ContactForm7 upload feature...
U.S. Dept Of Defense: Blind stored XSS due to insecure contact form at https://█████.mil leads to leakage of session token and
Summary: I have discovered a blind stored cross site scripting vulnerability due to an insecure Contact form available here https://███████.mil/ This form does not properly sanitize user input allowing for the insertion and submission of dangerous characters such as angle brackets. I was able to...
PrestaShop 1.6.0.4 < 1.7.6.8 XSS Vulnerability
PrestaShop is prone to a cross-site scripting XSS vulnerability. Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free...
PrestaShop Code Injection Vulnerability
PrestaShop is an open source e-commerce solution from PrestaShop, Inc. in the United States. The solution provides a variety of payment methods, short message alerts and product image scaling and other features. A security vulnerability exists in PrestaShop version 1.6.0.4, versions prior to...
CVE-2020-15161
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8...
CVE-2020-15161
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8...
Code injection
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8...
CVE-2020-15161
Summary: CVE-2020-15161 affects PrestaShop. Versions 1.6.0.4 and earlier than 1.7.6.8 allow an attacker to inject JavaScript via the contact form, due to improper handling of externally entered data during code snippet construction. The issue is addressed in version 1.7.6.8. Impact & context (per...
CVE-2020-15161 Potential XSS in PrestaShop
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8...
contact.comtous.net Cross Site Scripting vulnerability OBB-1352887
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.5.5 - Unauthenticated Remote Code Execution
The Drag and Drop Multiple File Upload – Contact Form 7 WordPress plugin was vulnerable to Remote Code Execution via file upload. The plugin used a blacklist of dangerous file extensions that it did not allow to be uploaded, however, the extensions .phar and .phpt were not within the blacklist,...
WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.5.4 - Unauthenticated Remote Code Execution vulnerability
Unauthenticated Remote Code Execution vulnerability found in WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin versions = 1.3.5.4. Solution Update the WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin to the latest available version at least 1.3.5.5...
Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.5.5 - Unauthenticated Remote Code Execution
The Drag and Drop Multiple File Upload – Contact Form 7 WordPress plugin was vulnerable to Remote Code Execution via file upload. The plugin used a blacklist of dangerous file extensions that it did not allow to be uploaded, however, the extensions .phar and .phpt were not within the blacklist,...
Cross-Site Scripting (XSS)
prestashop/contactform is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the message field...