WordPress Contact Form builder with drag & drop plugin <= 2.1.1 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by NinTechNet in WordPress Contact Form builder with drag & drop plugin versions = 2.1.1. Solution Update the WordPress Contact Form builder with drag & drop plugin to the latest available version at least 2.1.2...

Contact Form - Form builder by Kali Forms < 2.1.2 - Multiple CSRF Bypass Issues

Throughout the plugin’s code, security nonces can be bypassed because they are only checked if they are set...

WordPress Contact Form by WPForms plugin <= 1.6.0.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Fortinet in WordPress Contact Form by WPForms plugin versions = 1.6.0.1. Solution Update the WordPress Contact Form by WPForms plugin to the latest available version at least 1.6.0.2...

Design/Logic Flaw

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

CVE-2020-15412

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

CVE-2020-15412: Missing Authorization

An issue was discovered in MISP 2.4.128. app/Controller/EventsController.php lacks an event ACL check before proceeding to allow a user to send an event contact form...

CVE-2020-12800: Unrestricted Upload of File with Dangerous Type

The drag-and-drop-multiple-file-upload-contact-form-7 plugin before 1.3.3.3 for WordPress allows Unrestricted File Upload and remote code execution by setting supportedtype to php% and uploading a .php% file...

WordPress Drag and Drop Multi File Upload - Contact Form Code Issue Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Drag and Drop Multi File Upload - Contact Form is a drag-and-drop file upload and contact form plugin used in... A code issue...

PT-2020-13273

Name of the Vulnerable Software and Affected Versions drag-and-drop-multiple-file-upload-contact-form-7 plugin versions prior to 1.3.3.3 Description The issue allows for Unrestricted File Upload and remote code execution. This can be achieved by setting the supported type to php% and uploading a...

WordPress Drag And Drop Multi File Uploader Remote Code Execution

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'Wordpress Drag and Drop Multi File Uploader RCE', 'Description' = %q This module exploits a file upload feature of Drag and Drop Multi File Uploa...

WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin <= 1.3.3.2 - Unauthenticated File Upload vulnerability leading to Remote Code Execution (RCE)

Unauthenticated File Upload vulnerability leading to Remote Code Execution RCE discovered by Austin Martin in WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin versions = 1.3.3.2. Solution Update the WordPress Drag and Drop Multiple File Upload for Contact Form 7 plugin to th...

WordPress Drag And Drop File Upload Contact Form 1.3.3.2 Shell Upload

Exploit Title: WordPress Plugin Drag and Drop File Upload Contact Form 1.3.3.2 - Remote Code Execution Date: 2020-05-11 Exploit Author: Austin Martin Google Dork: inurl:wp-content/uploads/wpdndcf7uploads/ Google Dork: inurl:wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/...

Drag and Drop Multiple File Upload for Contact Form 7 < 1.3.3.3 - Unauthenticated File Upload Bypass

Due to the plugin not properly checking the file being uploaded via the dndcodedropzupload AJAX action, an attacker could bypass the checks in place and upload a PHP file. There was a working exploit provided along with this vulnerability. It also requires the Contact Form 7 plugin to be installe...

WordPress Plugin Drag and Drop File Upload Contact Form 1.3.3.2 - Remote Code Execution

Exploit Title: WordPress Plugin Drag and Drop File Upload Contact Form 1.3.3.2 - Remote Code Execution Date: 2020-05-11 Exploit Author: Austin Martin Google Dork: inurl:wp-content/uploads/wpdndcf7uploads/ Google Dork: inurl:wp-content/plugins/drag-and-drop-multiple-file-upload-contact-form-7/...

Add-on SweetAlert Contact Form 7 < 1.0.8 - Authenticated Stored Cross-Site Scripting (XSS)

Stored XSS "post-auth" in "tittle" field of the "Error Alert" and "Success Alert" sections of the plugin's settings page due to poor sanitization of entered characters. When you enter the payload and save the changes, it is permanently embedded in the html code of the settings page, so all users...

Add-on SweetAlert Contact Form 7 < 1.0.8 - Authenticated Stored Cross-Site Scripting (XSS)

Stored XSS "post-auth" in "tittle" field of the "Error Alert" and "Success Alert" sections of the plugin's settings page due to poor sanitization of entered characters. When you enter the payload and save the changes, it is permanently embedded in the html code of the settings page, so all users...

WordPress Add-on SweetAlert Contact Form 7 plugin <= 1.0.7 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability discovered by Juan M. in WordPress Add-on SweetAlert Contact Form 7 plugin versions = 1.0.7. Solution Update the WordPress Add-on SweetAlert Contact Form 7 plugin to the latest available version at least 1.0.8...

Topcoder: Blind stored XSS due to insecure contact form at https://www.topcoder.com leads to leakage of session token and other PII

Summary: I have discovered a blind stored cross site scripting vulnerability due to an insecure Contact form available here https://www.topcoder.com/contact-us/ This form does not properly sanitize user input allowing for the insertion and submission of dangerous characters such as angle brackets...

Exploit for Unrestricted Upload of File with Dangerous Type in Codedropz Drag_And_Drop_Multiple_File_Upload_-_Contact_Form_7

CVE-2020-12800 POC Script for CVE-2020-12800: RCE throug...

CVE-2020-11069 Cross-Site Request Forgery in TYPO3 CMS

In TYPO3 CMS 9.0.0 through 9.5.16 and 10.0.0 through 10.4.1, it has been discovered that the backend user interface and install tool are vulnerable to a same-site request forgery. A backend user can be tricked into interacting with a malicious resource an attacker previously managed to upload to...