278 matches found
CVE-2022-0248
The CVE-2022-0248 affects the WordPress plugin Contact Form Submissions prior to v1.7.3. The root cause is failure to sanitize/escape additional fields in contact form submissions, allowing unauthenticated attackers to trigger Cross-Site Scripting (XSS) when admins view a malicious submission. Pu...
WordPress plugin Contact Form Submissions 跨站脚本漏洞
WordPress is a set of blogging platforms developed by the Wordpress Foundation using the PHP language. WordPress plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in versions of the WordPress Contact Form Submissions plugin prior to 1.7.3, which stems from...
WordPress Contact Form Submissions plugin <= 1.7.2 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Yoru Oni in WordPress Contact Form Submissions plugin versions = 1.7.2. Solution Update the WordPress Contact Form Submissions plugin to the latest available version at least 1.7.3...
CVE-2021-24125
Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7contactform GET parameter when submitting a filter request as a high privilege user admin+...
CVE-2021-24125
Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7contactform GET parameter when submitting a filter request as a high privilege user admin+...
CVE-2021-24125
Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7contactform GET parameter when submitting a filter request as a high privilege user admin+...
CVE-2021-24125 Contact Form Submissions < 1.7.1 - Authenticated SQL Injection
Unvalidated input in the Contact Form Submissions WordPress plugin before 1.7.1, could lead to SQL injection in the wpcf7contactform GET parameter when submitting a filter request as a high privilege user admin+...
WordPress SQL注入漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in WordPress Contact Form Submissions plugin 1.6.4 and before,...
Contact Form Submissions <= 1.6.4 - Authenticated Double Query SQL injection
The plugin is affected by a double query SQL injection, which could allow high privileged users to access data from the DBMS. Edit WPScanTeam October 26th, 2020 - Confirmed & Escalated to WP October 27th, 2020 - WP Investigating January 3rd, 2021 - No updates, disclosing PoC The PoC will be...
WordPress Contact Form Submissions plugin <= 1.7 - Authenticated SQL Injection (SQLi) vulnerability
Authenticated SQL Injection SQLi vulnerability discovered by Sun research team in WordPress Contact Form Submissions plugin versions = 1.7. Solution Update the WordPress Contact Form Submissions plugin to the latest available version at least 1.7.1...
LibreOffice Input Validation Error Vulnerability (CNVD-2020-35943)
LibreOffice is an open source office software suite from The Document Foundation TDF. The product includes applications such as Writer text documents, Calc spreadsheets and Impress presentations. A security vulnerability exists in LibreOffice versions prior to 6.4.4. An attacker can exploit the...
DEBIAN-CVE-2020-12803
ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need f...
CVE-2020-12803
ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need f...
CVE-2020-12803
ODF documents can contain forms to be filled out by the user. Similar to HTML forms, the contained form data can be submitted to a URI, for example, to an external web server. To create submittable forms, ODF implements the XForms W3C standard, which allows data to be submitted without the need f...
DRUPAL-CONTRIB-2020-019
The reCaptcha v3 module enables you to protect your forms using the Google reCaptcha V3. If the reCaptcha v3 challenge succeeds, all the other form validations are bypassed. This makes it possible for attackers to submit invalid or incomplete forms. This vulnerability only affects forms that are...
Cross-site Request Forgery (CSRF)
SquirrelMail is vulnerable to cross-site request forgery CSRF. Form submissions in SquirrelMail did not implement protection against Cross-Site Request Forgery CSRF attacks. If a remote attacker tricked a user into visiting a malicious web page, the attacker could hijack that user's authenticatio...
WP Maintenance <= 5.0.5 - Cross-Site Request Forgery to Stored Cross-Site Scripting
No nonce protection on form submissions leading to CSRF and no input/output sanitization allowing for XSS when CSRF is exploited. PoC...
CVE-2019-10071
The code which checks HMAC in form submissions used String.equals for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison...
CVE-2019-10071
The code which checks HMAC in form submissions used String.equals for comparisons, which results in a timing side channel for the comparison of the HMAC signatures. This could lead to remote code execution if an attacker is able to determine the correct signature for their payload. The comparison...