745 matches found
WordPress Hotel Listing 3 Plugin - (Multiple) Cross-Site Scripting Vulnerability
Exploit Title: WordPress Plugin Hotel Listing 3 - 'Multiple' Cross-Site Scripting XSS Exploit Author: Vulnerability Lab Vendor Homepage: https://hotel.eplug-ins.com/ Software Link: https://hotel.eplug-ins.com/hoteldoc/ Version: v3 Document Title: =============== Hotel Listing WP Plugin v3.x -...
Hotel Listing < 1.3.3 - Authenticated Stored Cross-Site Scripting
The plugin does not sanitise and escape some of the Listing fields such as address, city, zipcode and country, which could lead to Stored Cross-Site Scripting issues...
country-online.com Cross Site Scripting vulnerability OBB-2152263
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CVE-2021-36873
Authenticated Persistent Cross-Site Scripting XSS vulnerability in WordPress iQ Block Country plugin versions = 1.2.11. Vulnerable parameter: &blockcountryblockmessage...
CVE-2021-36873
Authenticated Persistent Cross-Site Scripting XSS vulnerability in WordPress iQ Block Country plugin versions = 1.2.11. Vulnerable parameter: &blockcountryblockmessage...
CVE-2021-36873 WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability
Authenticated Persistent Cross-Site Scripting XSS vulnerability in WordPress iQ Block Country plugin versions = 1.2.11. Vulnerable parameter: &blockcountryblockmessage...
CVE-2021-36873 WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability
Authenticated Persistent Cross-Site Scripting XSS vulnerability in WordPress iQ Block Country plugin versions = 1.2.11. Vulnerable parameter: &blockcountryblockmessage...
CVE-2021-36873
CVE-2021-36873 affects WordPress plugin iQ Block Country (versions = 1.2.12). If upgrading is not feasible, apply mitigations per the patch sources. The connected documents confirm the vulnerability and the recommended fix; exploitation details are not provided beyond the general XSS description.
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...
Threat landscape for industrial automation systems in H1 2021
The H1 2021 ICS threat report at a glance Percentage of ICS computers attacked 1. During the first half of 2021 H1 2021, the percentage of attacked ICS computers was 8%, which was 0.4 percentage points p.p. higher than that for H2 2020. Percentage of ICS computers on which malicious objects were...
WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability
Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered by Vlad Visse Patchstack Red Team in WordPress iQ Block Country plugin versions = 1.2.11. Vulnerable parameter: &blockcountryblockmessage. Solution Update the WordPress iQ Block Country plugin to the latest available versi...
WordPress iQ Block Country plugin <= 1.2.11 - Authenticated Persistent Cross-Site Scripting (XSS) vulnerability
Authenticated Persistent Cross-Site Scripting XSS vulnerability discovered by Vlad Visse Patchstack Red Team in WordPress iQ Block Country plugin versions = 1.2.11. Vulnerable parameter: &blockcountryblockmessage. Solution Update the WordPress iQ Block Country plugin to the latest available versi...
iQ Block Country < 1.2.12 - Admin+ Stored Cross-Site Scripting
The plugin does not escape its blockcountryblockmessage setting, which could lead to Stored Cross-Site Scripting issue...
X (Formerly Twitter): Identify the mobile number of a twitter user
Summary: By exploiting this security vulnerability we can detect the mobile number of a twitter user. Description: This security vulnerability is of type "Information disclosure" it allows to exploit Flawed behavior of the twitter system to obtain distinct responses when different error states...
533 Million Facebook Users' Phone Numbers and Personal Data Leaked Online
In what's likely to be a goldmine for bad actors, personal information associated with approximately 533 million Facebook users worldwide has been leaked on a popular cybercrime forum for free—which was harvested by hackers in 2019 using a Facebook vulnerability. The leaked data includes full...
Showmax: https://secure.showmax.com/profile/payments
As part of testing user credentials distribution the security researchers were awarded 3 different activation codes, each one granting them subscription for a different country. The researcher reported that it's possible to use a code for country "A" with account associated to country "B". Such...
North Korean Hackers Used 'Torisma' Spyware in Job Offers-based Attacks
A cyberespionage campaign aimed at aerospace and defense sectors in order to install data gathering implants on victims' machines for purposes of surveillance and data exfiltration may have been more sophisticated than previously thought. The attacks, which targeted IP-addresses belonging to...
CVE-2020-0375
In Telephony, there is a possible permission bypass due to a missing permission check. This could lead to local escalation of privilege and the setting of supported EUICC countries with no additional execution privileges needed. User interaction is not needed for exploitation.Product:...
Chamber Dashboard Business Directory < 3.3.1 - Authenticated Stored Cross-Site Scripting
The plugin does not sanitise user input when creating or editing a business in the dashboard, allowing high privilege users Editor+ to set XSS payloads in various fields. Login as an editor or admin, then add/edit a business and set the phone number as " The payload will then be executed in the...
HackerOne: Recently added 'Country' field doesn't send email notification when changed
Summary: Hi team, This is a small bug report. Actually I think there is no important security issue but I wanted to report it ¯\ツ/¯ If you change your 'Country' information on account settings, HackerOne doesn't send Your profile was recently changed email. Description: There is an email...