9311 matches found
Easy WP SMTP < 1.5.0 - Admin+ PHP Objection Injection
The plugin unserialises the content of an imported file, which could lead to PHP object injection issue when an admin import intentionally or not a malicious file and a suitable gadget chain is present on the blog. PoC To simulate a gadget chain, put the following code in a plugin class Evil publ...
Joomla Easy Shop 1.4.1 Cross Site Scripting Vulnerability
┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ┌┘ Exploits ┌┘ └───────────────────────────────────────────────────────────────────────────────────────┘┘ : Author : CraCkEr : │ Website : extensions.joomla.org │ │ Vendor : JoomTech - joomtech.net │ │...
Joomla Easy Shop 1.4.1 Cross Site Scripting
┌┌───────────────────────────────────────────────────────────────────────────────────────┐ ││ C r a C k E r ┌┘ ┌┘ T H E C R A C K O F E T E R N A L M I G H T ││ └───────────────────────────────────────────────────────────────────────────────────────┘┘ ┌──── From The Ashes and Dust Rises An...
Easy Digital Downloads < 3.1.0.2 - Unauthenticated CSV Injection
The plugin does not validate data when its output in a CSV file, which could lead to CSV injection. PoC - Submit an order using =5+5 as "first name" and empty "last name" the plugin allows that. - Export the data as CSV from Reports Export. - Open the CSV with a spreadsheet application Excel,...
Easy Digital Downloads < 3.1.0.2 - Unauthenticated CSV Injection
The plugin does not validate data when its output in a CSV file, which could lead to CSV injection. - Submit an order using =5+5 as "first name" and empty "last name" the plugin allows that. - Export the data as CSV from Reports Export. - Open the CSV with a spreadsheet application Excel, Libre...
Meks Easy Social Share < 1.2.8 - Admin+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Intercept the request made when saving the setting...
WordPress Meks Easy Social Share plugin <= 1.2.7 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Meks Easy Social Share plugin versions = 1.2.7. Solution Update the WordPress Meks Easy Social Share plugin to the latest available version at least 1.2.8...
Easy Hosting Control Panel Cross-Site Request Forgery (CVE-2018-6458)
A cross-site request forgery vulnerability exists in Easy Hosting Control Panel. Successful exploitation of this vulnerability could allow a remote attacker to damage users system...
WordPress plugin Easy Org Chart跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Easy Org Chart version 3.1 and prior versions are vulnerable to cross-site scripting. An...
CVE-2022-36355
Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in PluginlySpeaking Easy Org Chart plugin = 3.1 at WordPress...
Cross site scripting
Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in PluginlySpeaking Easy Org Chart plugin = 3.1 at WordPress...
CVE-2022-36355
CVE-2022-36355 affects the WordPress plugin Easy Org Chart (PluginlySpeaking Easy Org Chart) version
CVE-2022-36355 WordPress Easy Org Chart plugin <= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in PluginlySpeaking Easy Org Chart plugin = 3.1 at WordPress...
CVE-2022-36355 WordPress Easy Org Chart plugin <= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in PluginlySpeaking Easy Org Chart plugin = 3.1 at WordPress...
PT-2022-23325 · Pluginlyspeaking · Pluginlyspeaking Easy Org Chart
Name of the Vulnerable Software and Affected Versions: PluginlySpeaking Easy Org Chart plugin versions prior to 3.2 Description: The issue is an Authenticated Stored Cross-Site Scripting XSS vulnerability. It affects the PluginlySpeaking Easy Org Chart plugin at WordPress, where contributors or...
WordPress Easy Org Chart plugin <= 3.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress Easy Org Chart plugin versions = 3.1. Solution Deactivate and delete. This plugin has been closed as of July 29, 2022 and is not available for download. This closure is...
WordPress plugin Easy Org Chart 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin. WordPress plugin Easy Org Chart version 3.1 and prior versions are vulnerable to cross-site scripting. An...
CVE-2022-36355: Improper Neutralization of Input During Web Page Generation
Authenticated contributor+ Stored Cross-Site Scripting XSS vulnerability in PluginlySpeaking Easy Org Chart plugin = 3.1 at WordPress...
Easy Org Chart <= 3.1 - Contributor+ Stored Cross-Site Scripting
The plugin does not sanitise and escape some parameters, which could allow users with a role as low as contributor to perform Cross-Site Scripting attacks...
