WordPress Plugin Contact Form Manager - Cross-Site Request Forgery / Cross-Site Scripting

!-- Source: https://sumofpwn.nl/advisory/2016/crosssiterequestforgerycrosssitescriptingincontactformmanagerwordpressplugin.html Abstract It was discovered that Contact Form Manager does not protect against Cross-Site Request Forgery. This allows an attacker to change arbitrary Contact Form Manage...

Bitrix Site Manager Cross Site Scripting

Hello list! There is Cross-Site Scripting vulnerability in Bitrix Site Manager. ------------------------- Affected products: ------------------------- Vulnerable was the last version of Bitrix Site Manager at 12.06.2015, when I found this vulnerability on web site of Russian terrorists. At that...

PHPMailer PwnScriptum Remote Code Execution

Added: 01/05/2017 BID: 95108 Background PHPMailer is a PHP class used for sending email from PHP. It is used by many open-source projects, e.g., WordPress, Drupal, and Joomla. Problem PHPMailer class mailSend function is vulnerable to command injection due to failure to properly sanitize the...

PHPMailer PwnScriptum Remote Code Execution

Added: 01/05/2017 BID: 95108 Background PHPMailer is a PHP class used for sending email from PHP. It is used by many open-source projects, e.g., WordPress, Drupal, and Joomla. Problem PHPMailer class mailSend function is vulnerable to command injection due to failure to properly sanitize the...

wienerberger.pl XSS vulnerability

Open Bug Bounty ID: OBB-202742 Description| Value ---|--- Affected Website:| wienerberger.pl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

PHPMailer / Zend-mail / SwiftMailer Remote Code Execution

!/usr/bin/python intro = """\03394m / / / / / / / / / / / / / / / / / / // / / / /// / / / / // / // / // / / / / // / // , / / / ///, /,// // //,///||// // // PHPMailer / Zend-mail / SwiftMailer - Remote Code Execution Exploit a.k.a "PwnScriptum" CVE-2016-10033 + CVE-2016-10045 +...

PHPMailer < 5.2.20 / SwiftMailer < 5.4.5-DEV / Zend Framework / zend-mail < 2.4.11 - 'AIO' 'PwnScriptum' Remote Code Execution

!/usr/bin/python intro = """\03394m / / / / / / / / / / / / / / / / / / // / / / /// / / / / // / // / // / / / / // / // , / / / ///, /,// // //,///||// // // PHPMailer / Zend-mail / SwiftMailer - Remote Code Execution Exploit a.k.a "PwnScriptum" CVE-2016-10033 + CVE-2016-10045 +...

vacances.seloger.com XSS vulnerability

Vulnerable URL:...

PHPMailer 5.2.20 - Remote Code Execution Exploit

Exploit for php platform in category web applications !/usr/bin/python intro = """ PHPMailer RCE PoC Exploits PHPMailer 5.2.18 Remote Code Execution PoC Exploit CVE-2016-10033 + PHPMailer 5.2.20 Remote Code Execution PoC Exploit CVE-2016-10045 the bypass of the first patch for CVE-2016-10033...

bosch.de XSS vulnerability

Vulnerable URL: http://www.bosch.de/de/de/contactform3/boschcontact.php?"+ Details: Description| Value ---|--- Patched:| Yes, at 11.11.2016 Latest check for patch:| 11.11.2016 21:44 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 102903 VIP website status:| No...

Cross-site scripting vulnerability in wordpress plugin contact-form-with-captcha

Contact Form With Captcha is a Wordpress plugin with CAPTCHA plugin Contact Form allows users to access Wordpress blogs using Google CAPTCHA form, it requires PHP 5 or higher. Wordpress plugin contact-form-with-captcha suffers from an xss vulnerability due to improper filtering of user input, whi...

practicesports.com XSS vulnerability

Vulnerable URL: http://www.practicesports.com/masassets/php/snapsports-contact.php?callback=prompt/OPENBUGBOUNTY/...

WordPress N-Media Website Contact Form Plugin - Arbitrary File Upload

The "upload.php" file can be uploaded to the /wp-content/uploads/contactfiles/ directory. Solution Update the plugin...

N-Media Website Contact Form with File Upload - Arbitrary File Upload

The website-contact-form-with-file-upload WordPress plugin was affected by an Arbitrary File Upload security vulnerability...

Mapbox: Blind XSS in mapbox.com/contact

@sahilsaif reported a stored blind XSS issue on www.mapbox.com/contact. To fix the issue we escaped user provided message content before sending to our middleware server...

WordPress Contact Form To Email Plugin <= 1.1.47 - Cross Site Scripting

Because of this vulnerability, attackers can inject malicious JavaScript code into the application. Solution Update the plugin...

Contact Form to Email <= 1.1.47 - Authenticated Reflected Cross-Site Scripting (XSS)

The Contact Form Email WordPress plugin was affected by an Authenticated Reflected Cross-Site Scripting XSS security vulnerability...

info.vassar.edu XSS vulnerability

Vulnerable URL: http://info.vassar.edu/contact.html?contact-form=true=%3Cscript%3Ealert%28%27OPENBUGBOUNTY%27%29%3C/script%3E=registrar Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Ran...

Mapbox Filter Bypass / Script Insertion

Document Title: =============== Mapbox API - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1787 ID: 119802 Release Date: ============= 2016-06-06 Vulnerability Laboratory ID VL-ID:...

Mapbox (API) - Filter Bypass & Persistent Vulnerability

Document Title: =============== Mapbox API - Filter Bypass & Persistent Vulnerability References Source: ==================== http://www.vulnerability-lab.com/getcontent.php?id=1787 ID: 119802 Release Date: ============= 2016-06-06 Vulnerability Laboratory ID VL-ID:...