CVE-2021-24514

The Visual Form Builder WordPress plugin before 3.0.4 does not sanitise or escape its Form Name, allowing high privilege users such as admin to set Cross-Site Scripting payload in them, even when the unfilteredhtml capability is disallowed...

WordPress 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Visual Form Builder prior to...

CVE-2020-8436

XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rmformid, rmtr, or formname parameter...

MOPCMS Cross-Site Scripting Vulnerability

MOPCMS is a content management system CMS based on PHP and MySQL. A cross-site scripting vulnerability exists in MOPCMS 2018-11-30 and earlier versions, which can be exploited by remote attackers to inject arbitrary web script or HTML with the help of the 'formname' parameter...

phpMyAdmin Denial of Service Vulnerability (CNVD-2017-24410)

phpMyAdmin is a free, web-based MySQL database management tool developed by the phpMyAdmin team. A security vulnerability exists in the replication status in phpMyAdmin. An attacker can exploit this vulnerability to cause a denial of service by using a specially crafted form name...

Discuz后台文件包含漏洞

简要描述： wooyun还是不错的 so 我又来了 要是被通用性漏洞奖励看中了就好了 详细说明： 漏洞函数在文件source\module\misc\miscseccode.php下面 请看代码 这段代码粗略一看没什么利用条件“./source/plugin/'.$etype0.'/seccode/seccode'.$etype1.'.php'”但是 我们把其中的/seccode/seccode这个变成文件夹 不就Ok了嘛 if!isnumeric$G'setting''seccodedata''type' $etype = explode':',...