9345 matches found
Booked < 2.2.6 - Broken Authentication to Export Users Data in CSV
The plugin allows users to Book Appointment by providing their PII such as Email, Name, Phone Number and Personal Message. The vulnerability allows anyone to Dump all records of users and their appointment details in CSV as an unauthenticated user. The user also gets registered as a WP User after...
CVE-2020-9466
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection...
Design/Logic Flaw
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection...
CVE-2020-9466
The Export Users to CSV plugin through 1.4.2 for WordPress allows CSV Injection...
CVE-2020-9466
CVE-2020-9466 affects the WordPress plugin Export Users to CSV (≤1.4.2). An attacker who can register as a subscriber can inject CSV payloads into user-details fields; when an authenticated admin exports user data to CSV and opens it, the payload can execute (e.g., redirections to malicious sites...
lavida.jp Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1105252 Security Researcher geeknik Helped patch 8748 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting lavida.jp website and its...
setagayatrain.tokyo Cross Site Scripting vulnerability
Security Researcher g0bl1nsec Helped patch 3668 vulnerabilities Received 4 Coordinated Disclosure badges Received 3 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting setagayatrain.tokyo website and its users. Following...
files4you.info Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1104604 Security Researcher geeknik Helped patch 8803 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting files4you.info website and...
megasport.ua Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1104318 Security Researcher raviakp1004 Helped patch 667 vulnerabilities Received 4 Coordinated Disclosure badges Received 5 recommendations , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting megasport.ua website and...
WordPress Export Users to CSV plugin <= 1.4.2 - CSV Injection vulnerability
CSV Injection vulnerability found by Jinson Varghese Behanan in WordPress Export Users to CSV plugin versions = 1.4.2. Solution 2020 Feb. 26 - no patched version available...
Export Users to CSV <= 1.4.2 - CSV Injection
An attacker can register themselves as a subscriber in a WordPress website and provide malicious payloads formula into the user account details field. When an authenticated admin uses the Export Users to CSV plugin to export the details of all the users into a CSV file and open it, the payload ge...
Windows/x86 - Null-Free WinExec Calc.exe Shellcode (195 bytes)
Title: Windows\x86 - Null-Free WinExec Calc.exe Shellcode 195 bytes Shellcode Author: Bobby Cooke Technique: PEB & Export Directory Table Tested On: Windows 10 Pro x86 10.0.18363 Build 18363 start: ; Create a new stack frame mov ebp, esp ; Set base stack pointer for new stack-frame sub esp, 0x20 ...
Export Users to CSV <= 1.4.2 - CSV Injection
An attacker can register themselves as a subscriber in a WordPress website and provide malicious payloads formula into the user account details field. When an authenticated admin uses the Export Users to CSV plugin to export the details of all the users into a CSV file and open it, the payload ge...
EulerOS 2.0 SP8 : git (EulerOS-SA-2020-1151)
According to the versions of the git packages installed, the EulerOS installation on the remote host is affected by the following vulnerabilities : - An issue was found in Git before v2.24.1, v2.23.1, v2.22.2, v2.21.1, v2.20.2, v2.19.3, v2.18.2, v2.17.3, v2.16.6, v2.15.4, and v2.14.6. The...
theimpossiblequizgames.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1101406 Security Researcher geeknik Helped patch 8826 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting theimpossiblequizgames.com...
rockefsaneleri.net Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1100808 Security Researcher geeknik Helped patch 8722 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting rockefsaneleri.net website...
csshero.org Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1098891 Security Researcher Broly157 Helped patch 1571 vulnerabilities Received 7 Coordinated Disclosure badges Received 15 recommendations , a holder of 7 badges for responsible and coordinated disclosure, found a security vulnerability affecting csshero.org website and i...
SUDO_KILLER - A Tool To Identify And Exploit Sudo Rules' Misconfigurations And Vulnerabilities Within Sudo
Linux Privilege Escalation through SUDO abuse. If you like the tool and for my personal motivation so as to develop other tools please a +1 star The tool can be used by pentesters, system admins, CTF players, students, System Auditors and trolls :. INTRO WARNING: SUDOKILLER is part of the KILLER...
ecutool.com Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1098751 Security Researcher Rbcafe Helped patch 258 vulnerabilities Received 3 Coordinated Disclosure badges Received 7 recommendations , a holder of 3 badges for responsible and coordinated disclosure, found a security vulnerability affecting ecutool.com website and its...
infodebit.md Cross Site Scripting vulnerability
Open Bug Bounty ID: OBB-1098726 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website...