4981 matches found
CVE-2025-7384
CVE-2025-7384 — Inyección de Objetos PHP a RCE Plugin: Database for Contact Form 7 contact-form-entries ≤ 1.4.3 CVSS: 9.8 Crítico CWE: CWE-502 — Deserialización de Datos No Confiables Requisito de autenticación: Ninguno No autenticado Impacto: Ejecución Remota de Código Tabla de Contenidos 1...
CVE-2026-5364
CVE-2026-5364 CVE-2026-5364 是一个 CVSS 8.1（高危）未认证任意文件上传漏洞，存在于 Drag and Drop File Upload for Contact Form 7 插件中。 CVE-2026-5364 — CF7 拖放文件上传 RCE 通过sanitizefilename 绕过实现未认证任意文件上传 CVSS 8.1（高危） | 受影响：= 1.1.3 | 已修复：1.1.4 📋 概述 字段| 值 ---|--- CVE ID| CVE-2026-5364 插件| Drag and Drop File Upload for Contact...
CVE-2025-3515
CVE-2025-3515 CVE‑2025‑3515 — Contact Form 7 的多文件拖放上传插件 描述： 通过 drag‑and‑drop‑multiple‑file‑upload‑contact‑form‑7 ≤1.3.8.9 版本可实现任意文件上传，允许上传 .phar 文件，从而在 Apache+modphp 环境下导致远程代码执行 :contentReferenceoaicite:29index=29。 CVSS（v3.1）： 8.1（高危）:contentReferenceoaicite:30index=30 补丁： 更新至 ≥1.3.9.0 版本...
Check-WP-CVE-2020-35489
Check-WP-CVE-2020-35489 CVE-2020-35489 CVE-2020-35489 存在于 WordPress 插件 Contact Form 7 5.3.1 及更早版本中。攻击者利用此漏洞可以绕过网站对允许上传文件类型的所有限制，直接上传任意类型的文件。 据估计，受影响网站多达 500 万 个。 PoC 将于 2020 年 12 月 31 日公布，以便用户有时间更新。 参考 https://wpscan.com/vulnerability/10508...
wp_CVE-2020-35489_checker
wpCVE-2020-35489checker CVE-2020-35489 - 简介 wpCVE-2020-35489checker 是一个 Python 命令行工具，用于检查 WordPress 网站是否存在 CVE-2020-35489 漏洞。该漏洞源于 WordPress Contact Form 7 插件 5.3.2 之前版本中的一个安全缺陷。由于输入验证和清理不足，该漏洞使未经身份验证的攻击者能够通过表单字段上传恶意脚本，进而可能导致在受影响站点上执行远程代码。 法律警告 本脚本 "wpCVE-2020-35489checker"...
Contact Form Entries < 1.2.4 - Cross-Site Scripting
The plugin does not sanitise and escape various parameters, such as formid, status, enddate, order, orderby and search before outputting them back in the admin page id: CVE-2021-25079 info: name: Contact Form Entries 1.2.4 - Cross-Site Scripting author: r3Y3r53 severity: medium description: | The...
Contact Form 7 Math Captcha <= 2.0.1 - Cross-site Scripting
The Contact Form 7 Math Captcha WordPress plugin through 2.0.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users. id: CVE-2024-6517 info: name: Contact Form 7 Math Captcha =...
Contact Form by BestWebSoft < 4.0.6 - Cross-Site Scripting
The contact-form-plugin plugin before 4.0.6 for WordPress has multiple XSS issues. id: CVE-2017-18491 info: name: Contact Form by BestWebSoft 4.0.6 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The contact-form-plugin plugin before 4.0.6 for WordPress has multiple X...
WordPress Supsystic Contact Form <1.7.15 - Cross-Site Scripting
WordPress Supsystic Contact Form plugin before 1.7.15 contains a cross-site scripting vulnerability. It does not sanitize the tab parameter of its options page before outputting it in an attribute. id: CVE-2021-24276 info: name: WordPress Supsystic Contact Form 1.7.15 - Cross-Site Scripting autho...
Drag and Drop Multiple File Upload - CF7 <= 1.3.9.6 - Remote Code Execution
Drag and Drop Multiple File Upload for Contact Form 7 WordPress plugin = 1.3.9.6 contains an unrestricted file upload caused by insufficient file type validation and bypass of filename sanitization with non-ASCII characters, letting unauthenticated attackers upload arbitrary files and achieve...
Contact Form Plugin by Fluent Forms < 5.1.17 - Unauthenticated Limited Privilege Escalation
The plugin is vulnerable to privilege escalation due to a missing capability check on the /wp-json/fluentform/v1/managers REST API endpoint. This makes it possible for unauthenticated attackers to grant users with Fluent Form management permissions which gives them access to all of the plugin's...
WordPress Contact Form 7 Captcha <0.1.2 - Cross-Site Scripting
WordPress Contact Form 7 Captcha plugin before 0.1.2 contains a reflected cross-site scripting vulnerability. It does not escape the $SERVER'REQUESTURI' parameter before outputting it back in an attribute. id: CVE-2022-2187 info: name: WordPress Contact Form 7 Captcha 0.1.2 - Cross-Site Scripting...
WordPress Contact Form 7 <1.3.6.3 - Stored Cross-Site Scripting
WordPress Contact Form 7 before 1.3.6.3 contains an unauthenticated stored cross-site scripting vulnerability in the Drag and Drop Multiple File Upload plugin. SVG files can be uploaded by default via the dndcodedropzupload AJAX action. id: CVE-2022-0595 info: name: WordPress Contact Form 7 1.3.6...
Contact Form to DB by BestWebSoft < 1.5.7 - Cross-Site Scripting
The contact-form-to-db plugin before 1.5.7 for WordPress has multiple XSS issues. id: CVE-2017-18492 info: name: Contact Form to DB by BestWebSoft 1.5.7 - Cross-Site Scripting author: luisfelipe146 severity: medium description: | The contact-form-to-db plugin before 1.5.7 for WordPress has multip...
Contact Form Generator <= 2.5.5 - Cross-Site Scripting
The Contact Form Generator plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'id' parameter in wp-admin/admin.php in versions up to, and including, 2.5.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to...
Check-WP-CVE-2020-35489
Check-WP-CVE-2020-35489 CVE-2020-35489 CVE-2020-35489 存在于 WordPress 插件 Contact Form 7 5.3.1 及更早版本中。通过利用此漏洞，攻击者可以绕过网站上关于允许上传文件类型的所有限制，直接上传任意类型的文件。 估计有 500万 个网站受到影响。 PoC 将于 2020 年 12 月 31 日公开，以便用户有时间进行更新。 参考 https://wpscan.com/vulnerability/10508...
CVE-2025-3515
CVE-2025-3515 - RCE por subida de archivos en WordPress Uso root@kitploit: python3 exploit.py Resumen CVE-2025-3515 es una vulnerabilidad de subida de archivos en el plugin de WordPress "Drag and Drop Multiple File Upload for Contact Form 7" que permite a atacantes no autenticados subir archivos...
CVE-2026-54390
CVE-2026-54390 — JTL Shop Smarty SSTI 批量利用 未认证联系表单 → 邮件主题 → fetch'string:' → 远程代码执行 概述 CVE-2026-54390 是 JTL Shop 5.2.0–5.7.1 中的一个严重（CVSS 9.8）未认证服务端模板注入漏洞。 SmartyRenderer::renderTemplate 方法将邮件主题行传递给 $smarty-fetch'string:' . $subject — 将其作为 Smarty 模板进行渲染。用户联系表单字段通过 parseSubject 中的 var 解析方式到达邮件主题，然后...
CVE-2024-42009
Roundcube Webmail 1.6.7 向け XSS エクスプロイト CVE-2024-42009 説明 このスクリプトは、Roundcube Webmail バージョン 1.6.7 の格納型 XSS 脆弱性 CVE-2024-42009 を悪用します。悪意のあるペイロードをウェブメールシステムに注入し、トリガーされると被害者の受信箱からメールコンテンツを窃取します。 機能 Python HTTP リスナーを使用して、盗まれたメールコンテンツをキャプチャしデコードします。 連絡先フォームを介して XSS ペイロードを送信します。 キャプチャしたメール本文を抽出して表示します。...