8754 matches found
PT-2023-9029 · Golang +10 · Golang +10
Name of the Vulnerable Software and Affected Versions: Golang affected versions not specified Description: The issue is related to the consumption of large amounts of CPU and memory when processing form inputs containing a large number of parts. This can be caused by several factors, including th...
Reflected XSS in interface/forms/eye_mag/js/eye_base.php
Description There exist a reflected XSS in /interface/forms/eyemag/js/eyebase.php in the 'providerID' parameter. Proof of Concept http://openemr.local/interface/forms/eyemag/js/eyebase.php?providerID=%3Cimg%20src=x%20onerror=alert1;%3E fix properly sanitize the providerID parameter...
IRS tax forms W-9 email scam drops Emotet malware
By Waqas Researchers have warned users to be on alert, as the IRS never sends emails to confirm taxpayers' personal information. This is a post from HackRead.com Read the original post: IRS tax forms W-9 email scam drops Emotet malware...
Easy Forms for MailChimp < 6.8.8 - Reflected XSS
The plugin does not sanitise and escape some parameters before outputting them back in the response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open a page with the following code this requires the attacker to...
WordPress NEX-Forms – Ultimate Form Builder Plugin < 8.3.3 is vulnerable to Cross Site Scripting (XSS)
Software NEX-Forms – Ultimate Form Builder Type Plugin Vulnerable versions 8.3.3 Fixed in 8.3.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0272 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID a3bd5c028514 Credits La...
CVE-2023-0816
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections...
CVE-2023-0816
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections...
CVE-2023-0272
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0272
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
Cross site scripting
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0272 NEX-Forms < 8.3.3 - Contributor+ Stored XSS
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0272 NEX-Forms < 8.3.3 - Contributor+ Stored XSS
The NEX-Forms WordPress plugin before 8.3.3 does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks...
CVE-2023-0272
CVE-2023-0272: NEX-Forms WordPress plugin before 8.3.3 is vulnerable to Stored XSS due to failure to validate/escape certain shortcode attributes before output. This can allow users with the contributor role and above to inject malicious scripts via shortcodes embedded in posts/pages. Root cause:...
CVE-2023-0816 Formidable Forms < 6.1 - IP Spoofing
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections...
CVE-2023-0816 Formidable Forms < 6.1 - IP Spoofing
The Formidable Forms WordPress plugin before 6.1 uses several potentially untrusted headers to determine the IP address of the client, leading to IP Address spoofing and bypass of anti-spam protections...
CVE-2023-0816
CVE-2023-0816 affects the WordPress plugin Formidable Forms (before 6.1). The vulnerability arises from using several potentially untrusted HTTP headers to determine the client IP address, enabling IP address spoofing and bypass of anti-spam protections. Affected versions: Formidable Forms
WordPress Contact Forms by Cimatti Plugin <= 1.5.4 is vulnerable to Cross Site Scripting (XSS)
Software Contact Forms by Cimatti Type Plugin Vulnerable versions = 1.5.4 Fixed in 1.5.5 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28781 Patch priority Medium CVSS severity Medium 7.1 Developer Cimatti Consulting PSID 6a3a28e27c2a Credits thien...
WordPress plugin Formidable Forms 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
PT-2023-3011 · WordPress · Gravity Forms
Name of the Vulnerable Software and Affected Versions: Gravity Forms versions n/a through 2.7.3 Description: The issue is related to the deserialization of untrusted data in Gravity Forms, which can be exploited by a remote attacker to gain read, modify, or delete access to files or execute...
