WordPress plugin Accept Donations with PayPal 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in the...

PT-2021-16087 · WordPress · Accept Donations With Paypal

Name of the Vulnerable Software and Affected Versions: Accept Donations with PayPal WordPress plugin versions prior to 1.3.1 Description: The issue is related to a lack of CSRF check in the process of creating new donation buttons, which are internally treated as posts. This allows an attacker to...

WordPress 跨站请求伪造漏洞

WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Accept Donations with PayPal plugin in versions prior to 1.3.1 has a cross-site request forgery...

WordPress Accept Donations with PayPal plugin <= 1.3 - Cross-Site Request Forgery (CSRF) vulnerability leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF vulnerability leading to Stored Cross-Site Scripting XSS discovered by dc11 in WordPress Accept Donations with PayPal plugin versions = 1.3. Solution Update the WordPress Accept Donations with PayPal plugin to the latest available version at least 1.3.1...

WordPress Accept Donations with PayPal plugin <= 1.3 - Cross-Site Request Forgery (CSRF) leading to Arbitrary Post Deletion

Cross-Site Request Forgery CSRF leading to Arbitrary Post Deletion discovered by dc11 in WordPress Accept Donations with PayPal plugin versions = 1.3. Solution Update the WordPress Accept Donations with PayPal plugin to the latest available version at least 1.3.1...

Default credentials

The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module not activated by default, which adds the rest route '/services/contributor/?P\d+, takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi...

WordPress 插件 SQL注入漏洞

WordPress Plugin is an open source application plugin for WordPress. A SQL injection vulnerability exists in the WordPress plugin Podlove Podcast Publisher, which stems from the fact that versions of the Podlove Podcast Publisher WordPress plugin prior to version 3.5.6 include a "Social and...

Podlove Podcast Publisher < 3.5.6 - Unauthenticated SQL Injection

The plugin contains a 'Social & Donations' module not activated by default, which adds the rest route '/services/contributor/?P\d+, takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi. PoC With the 'Social & Donations' module of the plugin activated...

Podlove Podcast Publisher < 3.5.6 - Unauthenticated SQL Injection

The plugin contains a 'Social & Donations' module not activated by default, which adds the rest route '/services/contributor/?P\d+, takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi. With the 'Social & Donations' module of the plugin activated. Permali...

CVE-2021-24554

The Paytm – Donation Plugin WordPress plugin through 1.3.2 does not sanitise, validate or escape the id GET parameter before using it in a SQL statement when deleting donations, leading to an authenticated SQL injection issue...

Hurricane-Related Scams

CISA warns users to remain on alert for malicious cyber activity targeting potential disaster victims and charitable donors following a hurricane. Fraudulent emails—often containing malicious links or attachments—are common after major natural disasters. Exercise caution in handling emails with...

Fraud Ring Launders Money Via Fake Charity Donations

A money-laundering fraud ring is targeting donation sites, taking advantage of the outpouring of charity sparked by the global pandemic. Dubbed Cart Crasher by the Sift security firm, the fraud ring leverages guest checkout options on donation sites to steal money and launder stolen payment cards...

Let’s Encrypt to Replace 200M Certificates a Day

Let’s Encrypt just announced an infrastructure makeover which means the open certificate authority CA is able to re-issue up to 200 million certificates in a 24-hour period, something the service said could be necessary in “some of the worst scenarios.” The upgrade comes a year after Let’s Encryp...

PayloadsAllTheThings

It is an offensive tool for general-purpose payloads. The repository contains a collection of payloads for various purposes, but no specific exploit or vulnerability is mentioned. The provided code snippet is a funding model configuration for GitHub Sponsors and Ko-fi, indicating that the...

PayloadsAllTheThings

It is an offensive tool for general-purpose payloads. The repository contains a collection of payloads for various purposes, but no specific exploit or vulnerability is identified. The provided code snippet is a funding model configuration for GitHub Sponsors and Ko-fi, indicating that the...

Indian PM Modi’s Twitter handle hacked to ask for Bitcoin donations

By Deeba Ahmed Hackers posted tweets from the personal Twitter account of PM Modi asking for donations in Bitcoin. This is a post from HackRead.com Read the original post: Indian PM Modi’s Twitter handle hacked to ask for Bitcoin donations...

Mail.ru: Data URI Stored XSS on Donations Page

XSS in donationalerts.com on donations page while previewing the text data:text/html;base64,PHNjcmlwdD5hbGVydCgiWFNTIEhlcmUiKTs8L3NjcmlwdD4K...

Seeing Book Shelves on Virtual Calls

I have a confession... for me, the best part of virtual calls, or seeing any reporter or commentator working for home, is being able to check out their book shelves. I never use computer video, because I want to preserve the world's bandwidth. That means I don't share what my book shelves look li...

Annual Protest to ‘Fight Krebs’ Raises €150K+

In 2018, KrebsOnSecurity unmasked the creators of Coinhive -- a now-defunct cryptocurrency mining service that was being massively abused by cybercriminals -- as the administrators of a popular German language image-hosting forum. In protest of that story, forum members donated hundreds of...

XCTR Hacking Tools - All in one tools for Information Gathering

All in one tools for Information Gathering. Instagram: Capture the Root Screenshots !https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjUEdanvvVAkPBOspZkX397JxyXjnDNIATd5XbLZxVTPLzyCRJ1sMpQaEF7hH6x35GxYAT9L82ooTzK-EdywccEmklcpKtxIEsLBAYYDYNiTp...