Cross-Site Scripting (XSS)

Response-batch is vulenrable to cross-site scripting XSS attacks. The JSONP endpoints are vulnerable to active content injection...

WordPress DTracker plugin content injection vulnerability (CNVD-2017-31142)

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language, which supports the setting up of personal blog sites on servers with PHP and MySQL.DTracker is one of the plugins used to track site downloads. A content injection vulnerability exists in...

WordPress DTracker plugin content injection vulnerability (CNVD-2017-31143)

WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.DTracker is one of the plug-ins used to track site downloads. A content injection vulnerability exists in version 1.5 of...

GSA Bounty: Content injection via URL parameter.

Hello, The following URL is vulnerable to content & code injection. https://labs.data.gov/dashboard/validate...

http-vuln-cve2017-1001000 NSE Script

Attempts to detect a privilege escalation vulnerability in Wordpress 4.7.0 and 4.7.1 that allows unauthenticated users to inject content in posts. The script connects to the Wordpress REST API to obtain the list of published posts and grabs the user id and date from there. Then it attempts to...

WordPress Easy WP SMTP Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. WordPress can also be used as a content management system CMS. A cross-site scripting vulnerability exists in WordPress Easy WP SMTP...

Nextcloud: Content (Text) Injection at https://nextcloud.com

Hi, I may have found a ContentText Injection on this domain https://nextcloud.com PoC: https://nextcloud.com/federation/[email protected] and please fill your account infomation in http://form.google.com/xasw Let me know if you need more information...

Coinbase: [buy.coinbase.com]Content Injection

Hello Coinbase Details I'm not sure if this issue will count, i just want to make sure that is why i submit it. The parameter code is Vulnerable in Content Injection allowing me to inject any Text. Proof Of Concept Here is my PoC: F173393 and this which the text overlaps on the modal. F173394 PoC...

WordPress Core before 4.7 Stored XSS

As you might remember, we recently blogged about a critical Content Injection Vulnerability in WordPress which allowed attackers to deface vulnerable websites. While our original disclosure only described one vulnerability, we actually reported two to the WordPress team. As it turns out, it was...

WordPress DTracker plugin content injection vulnerability (CNVD-2017-03798)

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A content injection vulnerability exists in the WordPress DTracker plugin, which stems from the program failing ...

WordPress DTracker plugin content injection vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A content injection vulnerability exists in the WordPress DTracker plugin, which stems from the program failing ...

AXIS Communications - Cross-Site Scripting Content Injection

AXIS Communications - Cross-Site Scripting Content Injection 0RWELLL4BS security advisory olsa-2015-8258 PGP: 79A6CCC0 @orwelllabs Advisory Information ==================== - Title: ImagePath Resource Injection/Open script editor - Vendor: AXIS Communications - Research and Advisory: Orwelllabs -...

AXIS Communications - Cross-Site Scripting / Content Injection

0RWELLL4BS security advisory olsa-2015-8258 PGP: 79A6CCC0 @orwelllabs Advisory Information ==================== - Title: ImagePath Resource Injection/Open script editor - Vendor: AXIS Communications - Research and Advisory: Orwelllabs - Class: Improper Input Validation CWE-20 - CVE Name:...

Microsoft Exchange Server Remote Privilege Escalation Vulnerability (4013242)

This host is missing an important security update according to Microsoft Bulletin MS17-015. SPDX-FileCopyrightText: 2017 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE...

WordPress REST API Bug Could Be Used in Stored XSS Attacks

The recently patched WordPress REST API Endpoint vulnerability is the gift that keeps on giving. Already responsible for more than one million website defacements and attempts to monetize some of those attacks, the flaw also opens the door to a separate attack. Researchers at Sucuri who found the...

KLA10982 PE vulnerability in Microsoft Server Software

An improper handling of web requests was found in Microsoft Outlook Web Access. By exploiting this vulnerability malicious users can gain privileges. A successful exploit allows attackers to perform content/script injection attacks, make user disclose sensitive information. This vulnerability can...

WordPress 4.7 / 4.7.1 REST API Content Injection Exploit

Usage Info msf use auxiliary/scanner/http/wordpresscontentinjection msf auxiliarywordpresscontentinjection show actions ...actions... msf auxiliarywordpresscontentinjection set ACTION msf auxiliarywordpresscontentinjection show options ...show and set options... msf...

Wordpress 4.7.0/4.7.1 Content Injection Vulnerability

WordPress is a free and open source blogging software and content management system that uses PHP and MySQL as its platform. A content injection vulnerability exists in WordPress version 4.7.0/4.7.1. An unauthenticated attacker can exploit the vulnerability to perform content injection operations...

OLX: Combined attacks leading to stealing user's account

Hello, First: I have found out that when I register an account with the an email already used it doesn't tell anything but it sends a link to the registered email and when the user visits the link the password is changed without any further checking if the user was the one who asked for password...

U.S. Dept Of Defense: Content-Injection/XSS ████

Summary: Hi, It is possible to inject content and vulnerable to reflected Cross Site Scripting. Affected domain: https://██████████ Used browser: Mozilla. Impact One of the most common XSS attack vectors is to hijack legitimate user accounts by stealing their session cookies. This allows attacker...