CVE-2020-15178 Potential XSS in PrestaShop contactform

In PrestaShop contactform module prestashop/contactform before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The message field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript in a victim's browser...

Potential XSS injection In PrestaShop contactform

Impact An attacker is able to inject javascript while using the contact form. Patches The problem is fixed in v4.3.0 References Cross-site Scripting XSS - Stored CWE-79...

GHSA-95HX-62RH-GG96 Potential XSS injection In PrestaShop contactform

Impact An attacker is able to inject javascript while using the contact form. Patches The problem is fixed in v4.3.0 References Cross-site Scripting XSS - Stored CWE-79...

Contact Form - Form builder by Kali Forms < 2.1.2 - Multiple CSRF Bypass Issues

Throughout the plugin’s code, security nonces can be bypassed because they are only checked if they are set...

WordPress Contact Form builder with drag & drop plugin <= 2.1.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities

Multiple Cross-Site Request Forgery CSRF vulnerabilities discovered by NinTechNet in WordPress Contact Form builder with drag & drop plugin versions = 2.1.1. Solution Update the WordPress Contact Form builder with drag & drop plugin to the latest available version at least 2.1.2...

Contact Form - Form builder by Kali Forms < 2.1.2 - Unauthenticated Arbitrary Post Deletion

The plugin registers the kaliformsformdeleteuploadedfile AJAX action to call the "deletefile" function, and makes it accessible to all users, authenticated or not...

WordPress Contact Form builder with drag & drop plugin <= 2.1.1 - Authenticated Plugin Settings Change vulnerability

Authenticated Plugin Settings Change vulnerability discovered by NinTechNet in WordPress Contact Form builder with drag & drop plugin versions = 2.1.1. Solution Update the WordPress Contact Form builder with drag & drop plugin to the latest available version at least 2.1.2...

WordPress Contact Form builder with drag & drop plugin <= 2.1.1 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by NinTechNet in WordPress Contact Form builder with drag & drop plugin versions = 2.1.1. Solution Update the WordPress Contact Form builder with drag & drop plugin to the latest available version at least 2.1.2...

WordPress Contact Form by WPForms plugin <= 1.6.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Fortinet in WordPress Contact Form by WPForms plugin versions = 1.6.0.1. Solution Update the WordPress Contact Form by WPForms plugin to the latest available version at least 1.6.0.2...

Design/Logic Flaw

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

CVE-2020-15412

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

WordPress Drag and Drop Multi File Upload - Contact Form Code Issue Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Drag and Drop Multi File Upload - Contact Form is a drag-and-drop file upload and contact form plugin used in... A code issue...

WordPress Drag And Drop Multi File Uploader Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress Drag and Drop Multi File Uploader RCE', 'Description' = %q This module exploits a file upload feature of Drag and Drop Multi File Uploa...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin <= 1.3.3.2 - Unauthenticated File Upload vulnerability leading to Remote Code Execution (RCE)

Unauthenticated File Upload vulnerability leading to Remote Code Execution RCE discovered by Austin Martin in WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin versions = 1.3.3.2. Solution Update the WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin to th...

WordPress Drag And Drop File Upload Contact Form 1.3.3.2 Shell Upload

Exploit Title: WordPress Plugin Drag and Drop File Upload Contact Form 1.3.3.2 - Remote Code Execution Date: 2020-05-11 Exploit Author: Austin Martin Google Dork: inurl:wp-content/uploads/wpdndcf7uploads/ Google Dork: inurl:wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/...

WordPress Plugin Drag and Drop File Upload Contact Form 1.3.3.2 - Remote Code Execution

Exploit Title: WordPress Plugin Drag and Drop File Upload Contact Form 1.3.3.2 - Remote Code Execution Date: 2020-05-11 Exploit Author: Austin Martin Google Dork: inurl:wp-content/uploads/wpdndcf7uploads/ Google Dork: inurl:wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/...

Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.3.3 - Unauthenticated File Upload Bypass

Due to the plugin not properly checking the file being uploaded via the dndcodedropzupload AJAX action, an attacker could bypass the checks in place and upload a PHP file. There was a working exploit provided along with this vulnerability. It also requires the Contact Form 7 plugin to be installe...

Add-on SweetAlert Contact Form 7 < 1.0.8 - Authenticated Stored Cross-Site Scripting (XSS)

Stored XSS "post-auth" in "tittle" field of the "Error Alert" and "Success Alert" sections of the plugin's settings page due to poor sanitization of entered characters. When you enter the payload and save the changes, it is permanently embedded in the html code of the settings page, so all users...

Add-on SweetAlert Contact Form 7 < 1.0.8 - Authenticated Stored Cross-Site Scripting (XSS)

Stored XSS "post-auth" in "tittle" field of the "Error Alert" and "Success Alert" sections of the plugin's settings page due to poor sanitization of entered characters. When you enter the payload and save the changes, it is permanently embedded in the html code of the settings page, so all users...

WordPress Add-on SweetAlert Contact Form 7 plugin <= 1.0.7 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability discovered by Juan M. in WordPress Add-on SweetAlert Contact Form 7 plugin versions = 1.0.7. Solution Update the WordPress Add-on SweetAlert Contact Form 7 plugin to the latest available version at least 1.0.8...