Easy Form Builder WordPress插件代码问题漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An arbitrary file upload vulnerability exists in version 1.0 of the Easy Form Builder WordPress...

CVE-2021-24224: Unrestricted Upload of File with Dangerous Type

The EFBPverifyuploadfile AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE...

CVE-2021-24166: Cross-Site Request Forgery (CSRF)

The wpajaxnfoauthdisconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection...

WordPress Drag and Drop Form Builder 信息泄露漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An information disclosure vulnerability exists in the Drag and Drop Form Builder for WordPress plugi...

CVE-2021-24163: Exposure of Sensitive Information to an Unauthorized Actor

The AJAX action, wpajaxninjaformssendwpremoteinstallhandler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form...

WordPress插件Drag and Drop Form Builder 跨站请求伪造漏洞

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. related Posts is used in which a related content addition plug-in. iframe is used in which a document for another...

Easy Form Builder <= 1.0 - Unauthorised AJAX calls

While confirming https://wpscan.com/vulnerability/ed0c054b-54bf-4df8-9015-c76704c93484, we noticed that all AJAX actions of the plugin, available to authenticated users, do not have any CSRF and authorisation checks in place, allowing low privilege users to call them and delete/edit arbitrary for...

Easy Form Builder <= 1.0 - Unauthorised AJAX calls

While confirming https://wpscan.com/vulnerability/ed0c054b-54bf-4df8-9015-c76704c93484, we noticed that all AJAX actions of the plugin, available to authenticated users, do not have any CSRF and authorisation checks in place, allowing low privilege users to call them and delete/edit arbitrary for...

WordPress Easy Form Builder plugin <= 1.0 - Unauthorized AJAX Calls vulnerability

Unauthorized AJAX Calls vulnerability discovered by WPScan Team in WordPress Easy Form Builder plugin versions = 1.0. Solution Plugin closed. Deactivate and delete...

Easy Form Builder <= 1.0 - Authenticated Arbitrary File Upload

The EFBPverifyuploadfile AJAX action of the plugin, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE. PoC The PoC will be displayed once the issue has been remediated...

WordPress Formidable Form Builder plugin <= 4.09.04 - Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Maximilian Barz in WordPress Formidable Form Builder plugin versions = 4.09.04. Solution Update the WordPress Formidable Form Builder plugin to the latest available version at least 4.09.05...

Contact Form - Form builder by Kali Forms < 2.1.2 - Unauthenticated Arbitrary Post Deletion

The plugin registers the kaliformsformdeleteuploadedfile AJAX action to call the "deletefile" function, and makes it accessible to all users, authenticated or not...

WordPress Contact Form builder with drag & drop plugin <= 2.1.1 - Unauthenticated Arbitrary Post Deletion vulnerability

Unauthenticated Arbitrary Post Deletion vulnerability discovered by NinTechNet in WordPress Contact Form builder with drag & drop plugin versions = 2.1.1. Solution Update the WordPress Contact Form builder with drag & drop plugin to the latest available version at least 2.1.2...

Adobe Magento Form Builder Cross-Site Scripting Vulnerability

Adobe Magento is the United States Odo than Adobe company's set of open source PHP e-commerce system . The system provides rights management , search engines and payment gateways and other features . Form Builder is used in which a form to build extensions . Adobe Magento in the Form Builder...

CVE-2020-13423

Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Currenturl or email field, or the User-Agent HTTP header...

CVE-2020-13423

Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Currenturl or email field, or the User-Agent HTTP header...

Cross site scripting

Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Currenturl or email field, or the User-Agent HTTP header...

CVE-2020-13423

CVE-2020-13423 concerns a cross-site scripting vulnerability in Form Builder 2.1.0 for Magento. The connected documents confirm that the issue enables XSS against Magento 2 admin accounts via input channels including the Current_url field, the email field, and the User-Agent HTTP header. The root...

CVE-2020-13423

Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Currenturl or email field, or the User-Agent HTTP header...

CVE-2020-13423: Improper Neutralization of Input During Web Page Generation

Form Builder 2.1.0 for Magento has multiple XSS issues that can be exploited against Magento 2 admin accounts via the Currenturl or email field, or the User-Agent HTTP header...