Formidable Forms <= 2.05.02 - Multiple Vulnerabilities

The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress WordPress plugin was affected by a Multiple Vulnerabilities security vulnerability...

WordPress Caldera Forms plugin <=1.5.4 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by Will Brand in WordPress Caldera Forms plugin versions =1.5.4. Solution Update the WordPress Caldera Forms plugin to the latest available version at least version 1.5.5...

TYPO3 CMS cross-site scripting vulnerability (CNVD-2017-34699)

TYPO3 CMS is a free and open source content management system framework CMS/CMF maintained by the Swiss TYPO3 Association. Multiple cross-site scripting vulnerabilities exist in TYPO3 CMS. The vulnerabilities can be exploited by remote attackers to inject arbitrary web script or HTML by sending...

Shortcodes Ultimate <= 5.0.0 - Authenticated Contributor Code Execution

The Shortcodes Ultimate plugin does not sanitize the "filter" argument to the "sumeta", "suuser", and "supost" shortcodes, allowing the filter to be set to the "system" function which runs arbitrary code. This is being exploited in the wild; I discovered this though analysis of modsecurity audit...

VK.com: Stored xss в /lead_forms_app.php

XSS в "Форме сбора заявок". Жесть...

WordPress Polls 1.2.4 SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title :WordPress Polls plugin1.2.4 SQL Injection vulnerability Author : Manish Kishan Tanwar AKA error1046 https://twitter.com/IndiShell1046 Date : 22/10/2017 Vulnerable version: 1.2.4 Download Link :...

CVE-2010-3659

Multiple cross-site scripting XSS vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified...

CVE-2010-3659

Multiple cross-site scripting XSS vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified...

CVE-2010-3659

Multiple cross-site scripting XSS vulnerabilities in TYPO3 CMS 4.1.x before 4.1.14, 4.2.x before 4.2.13, 4.3.x before 4.3.4, and 4.4.x before 4.4.1 allow remote authenticated backend users to inject arbitrary web script or HTML via unspecified parameters to the extension manager, or unspecified...

CVE-2017-10324

Vulnerability in the Oracle Applications Technology Stack component of Oracle E-Business Suite subcomponent: Oracle Forms. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network acce...

Design/Logic Flaw

Vulnerability in the Oracle Applications Technology Stack component of Oracle E-Business Suite subcomponent: Oracle Forms. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network acce...

Design/Logic Flaw

Vulnerability in the Oracle Applications Technology Stack component of Oracle E-Business Suite subcomponent: Oracle Forms. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network acce...

CVE-2017-10066

Vulnerability in the Oracle Applications Technology Stack component of Oracle E-Business Suite subcomponent: Oracle Forms. Supported versions that are affected are 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6 and 12.2.7. Easily exploitable vulnerability allows unauthenticated attacker with network acce...

CVE-2017-10324

CVE-2017-10324 affects Oracle Applications Technology Stack (Oracle Forms) within Oracle E-Business Suite. Affected are versions 12.1.3, 12.2.3, 12.2.4, 12.2.5, 12.2.6, and 12.2.7. The vulnerability allows unauthenticated, network-accessible reads via HTTP to a subset of Oracle Applications Techn...

Unspecified Vulnerability in Oracle Applications Technology Stack

Oracle E-Business Suite E-Business Suite is a set of Oracle's fully integrated global business management software, of which the Oracle Applications Technology Stack is a component. An unspecified vulnerability exists in the Oracle Forms subcomponent of the Oracle Applications Technology Stack...

Unspecified Vulnerability in Oracle Applications Technology Stack (CNVD-2017-31498)

Oracle E-Business Suite E-Business Suite is a set of Oracle's fully integrated global business management software, of which the Oracle Applications Technology Stack is a component. An unspecified vulnerability exists in the Oracle Forms subcomponent of the Oracle Applications Technology Stack...

Memory Corruption Vulnerability in WPS Forms (CNVD-2017-34138)

WPS Office is an office software suite developed independently by Kingsoft Corporation. A memory corruption vulnerability exists in the excelrw module of formset.exe in WPS when parsing a specific xls file, which can be exploited by an attacker to cause a denial of service or code execution...

WordPress RegistrationMagic-Custom Registration Forms SQL Injection

SQL Injection vulnerability in WordPress RegistrationMagic-Custom Registration Forms plugin includes/classrmdbmanager.php Vulnerability Type: SQL Injection For the exploit source code contact DSquare Security sales team...

WordPress cp-contact-form-with-paypal plugin cross-site request forgery vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. cp-contact-form-with-paypal aka CP Contact Form with PayPal plugin is one of the payment plugins. A cross-site...

PT-2017-12723 · Silverstripe · Silverstripe Cms

Name of the Vulnerable Software and Affected Versions: SilverStripe CMS versions prior to 3.5.5 SilverStripe CMS versions 3.6.x prior to 3.6.1 Description: The issue allows remote attackers to enumerate users via timing attacks due to response discrepancy in the login and password reset forms...