WordPress plugin 'FormCraft' cross-site request forgery vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin 'FormCraft'. If a user logs into the WordPress admi...

WordPress plugin "FormCraft" vulnerable to cross-site request forgery

Overview The WordPress plugin "FormCraft" provided by nCrafts contains a cross-site request forgery vulnerability CWE-352. Masaki Saito of TDU Cryptography Lab. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impac...

MachForm < 4.2.3 - SQL Injection / Path Traversal / Upload Bypass

Vendor: Appnitro Product webpage: https://www.machform.com/ Full-Disclose: https://metalamin.github.io/MachForm-not-0-day-EN/ Fix: https://www.machform.com/blog-machform-423-security-release/ Author: Amine Taouirsa Twitter: @metalamin Google dork examples: ---------------------- "machform"...

StoreFront Logon Error "Your Request Could Not be Completed"

User are unable to logon and get Event ID 7 and 8 in the event logs, with errors "The template named: UsernamePassword could not be found." and an exception "The creation of a form failed"...

Win32k Forms Creation Denial of Service Vulnerability

Win32k.sys is a multi-user management driver file for Windows XP. There is a denial-of-service vulnerability in Win32k form creation, which occurs when a parameter in a system service function in Win32k.sys fails to be correctly checked, causing the local kernel to deny service when the user runs...

vbenterprise-overflow.txt

----------------------------------------------------------------------------- Visual Basic Enterprise Edition SP6 vb6skit.dll Buffer Overflow url: http://www.microsoft.com Author: shinnai mail: shinnaiatautisticidotorg site: http://shinnai.altervista.org This was written for educational purpose...

[Full-Disclosure] CGI.pm vulnerable to Cross-site Scripting.

Advisory Title: CGI.pm vulnerable to Cross-site Scripting. Release Date: July 19 2003 Application: CGI.pm - which is by default included in many common Perl distributions. Platform: Most platforms. Tested on Apache and IIS. Version: CGI.pm Severity: Effects scripts which make use of startform...