6179 matches found
CVE-2020-15161
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8...
CVE-2020-15161
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8...
Code injection
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8...
CVE-2020-15161
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8...
CVE-2020-15161 Potential XSS in PrestaShop
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8...
CVE-2020-15161
Summary: CVE-2020-15161 affects PrestaShop. Versions 1.6.0.4 and earlier than 1.7.6.8 allow an attacker to inject JavaScript via the contact form, due to improper handling of externally entered data during code snippet construction. The issue is addressed in version 1.7.6.8. Impact & context (per...
CVE-2020-15161: Improper Neutralization of Input During Web Page Generation
In PrestaShop from version 1.6.0.4 and before version 1.7.6.8 an attacker is able to inject javascript while using the contact form. The problem is fixed in 1.7.6.8...
PT-2020-14237
Name of the Vulnerable Software and Affected Versions PrestaShop versions 1.6.0.4 through 1.7.6.7 Description The issue allows an attacker to inject javascript when using the contact form. The problem is fixed in version 1.7.6.8. Recommendations For PrestaShop versions 1.6.0.4 through 1.7.6.7,...
PT-2020-15726
CVE-2020-24389: Remote Code Execution on WordPress Drag and Drop Multiple File Upload =1.3.5.4 - Contact Form 7 PoC https://sysdream.com/news/lab/2020-09-21-cve-2020-24389-remote-code-execution-on-drag-and-drop-multiple-file-upload-contact-form-7/...
contact.comtous.net Cross Site Scripting vulnerability OBB-1352887
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.5.5 - Unauthenticated Remote Code Execution
The Drag and Drop Multiple File Upload – Contact Form 7 WordPress plugin was vulnerable to Remote Code Execution via file upload. The plugin used a blacklist of dangerous file extensions that it did not allow to be uploaded, however, the extensions .phar and .phpt were not within the blacklist,...
WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin <= 1.3.5.4 - Unauthenticated Remote Code Execution vulnerability
Unauthenticated Remote Code Execution vulnerability found in WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin versions = 1.3.5.4. Solution Update the WordPress Drag and Drop Multiple File Upload – Contact Form 7 plugin to the latest available version at least 1.3.5.5...
Drag and Drop Multiple File Upload – Contact Form 7 < 1.3.5.5 - Unauthenticated Remote Code Execution
The Drag and Drop Multiple File Upload – Contact Form 7 WordPress plugin was vulnerable to Remote Code Execution via file upload. The plugin used a blacklist of dangerous file extensions that it did not allow to be uploaded, however, the extensions .phar and .phpt were not within the blacklist,...
Cross-Site Scripting (XSS)
prestashop/contactform is vulnerable to cross-site scripting XSS. An attacker is able to inject and execute arbitrary Javascript in a user's browser via the message field...
CVE-2020-15178 Potential XSS in PrestaShop contactform
In PrestaShop contactform module prestashop/contactform before version 4.3.0, an attacker is able to inject JavaScript while using the contact form. The message field was incorrectly unescaped, possibly allowing attackers to execute arbitrary JavaScript in a victim's browser...
Potential XSS injection In PrestaShop contactform
Impact An attacker is able to inject javascript while using the contact form. Patches The problem is fixed in v4.3.0 References Cross-site Scripting XSS - Stored CWE-79...
GHSA-95HX-62RH-GG96 Potential XSS injection In PrestaShop contactform
Impact An attacker is able to inject javascript while using the contact form. Patches The problem is fixed in v4.3.0 References Cross-site Scripting XSS - Stored CWE-79...
WordPress Contact Form builder with drag & drop plugin <= 2.1.1 - Authenticated Plugin Settings Change vulnerability
Authenticated Plugin Settings Change vulnerability discovered by NinTechNet in WordPress Contact Form builder with drag & drop plugin versions = 2.1.1. Solution Update the WordPress Contact Form builder with drag & drop plugin to the latest available version at least 2.1.2...
Contact Form - Form builder by Kali Forms < 2.1.2 - Unauthenticated Arbitrary Post Deletion
The plugin registers the kaliformsformdeleteuploadedfile AJAX action to call the "deletefile" function, and makes it accessible to all users, authenticated or not...
WordPress Contact Form builder with drag & drop plugin <= 2.1.1 - Multiple Cross-Site Request Forgery (CSRF) vulnerabilities
Multiple Cross-Site Request Forgery CSRF vulnerabilities discovered by NinTechNet in WordPress Contact Form builder with drag & drop plugin versions = 2.1.1. Solution Update the WordPress Contact Form builder with drag & drop plugin to the latest available version at least 2.1.2...