Cross site scripting

The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

CVE-2021-24856

CVE-2021-24856 affects WordPress Shared Files plugin versions prior to 1.6.61. The vulnerability is a stored XSS in the Download Counter Text setting caused by insufficient sanitization/escaping, allowing an attacker with high privileges to execute JavaScript in the victim’s browser even when unf...

CVE-2021-24856: Improper Neutralization of Input During Web Page Generation

The Shared Files WordPress plugin before 1.6.61 does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed...

PT-2021-16338

Name of the Vulnerable Software and Affected Versions: Shared Files WordPress plugin versions prior to 1.6.61 Description: The issue concerns the Shared Files WordPress plugin, where the Download Counter Text settings are not properly sanitized and escaped. This could allow high-privilege users t...

Shared Files < 1.6.61 - Admin+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Download Counter Text settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Put the following payload in the Download Counter Text settings and tick the Show...

My Click Counter Authentication Bypass Vulnerability

My Click Counter is a PHP-based click counter that can also be used as a download counter. An authentication bypass vulnerability exists in the administrator login page of My Click Counter version 1.0, which can be exploited by attackers to gain administrator privileges...

SQL Injection vulnerability in Simple Download Counter

Здравствуйте 3APA3A! Сообщаю вам о найденной мною SQL Injection уязвимости в Simple Download Counter. SQL Injection: Её можно использовать как для получения информации в частности других веб приложений с БД: http://site/xmlout.php?file='20union20select2020from20table/ Так и для проведения DoS ата...