CVE-2015-6969: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/2k11.min.js in the 2k11 theme in Serendipity before 2.0.2 allows remote attackers to inject arbitrary web script or HTML via a user name in a comment, which is not properly handled in a Reply link...

PT-2015-7429

Name of the Vulnerable Software and Affected Versions Serendipity versions prior to 2.0.2 Description A cross-site scripting XSS issue exists due to improper handling of user input in the 2k11 theme, specifically in the js/2k11.min.js file. This allows remote attackers to inject arbitrary web...

CVE-2015-6920

Cross-site scripting XSS vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter...

PT-2015-7404

Name of the Vulnerable Software and Affected Versions sourceAFRICA plugin version 0.1.3 Description The issue is related to a cross-site scripting XSS vulnerability. This allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter in the js/window.php file...

CVE-2015-6920: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/window.php in the sourceAFRICA plugin 0.1.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter...

AnyMacro邮件系统存储XSS漏洞2(可盲打其它用户)

简要描述： 第一弹被忽略了，目测是厂商一直没关注wooyun，导致过期自动忽略的。 可以考虑直接转交给CNCERT处理 http://www.wooyun.org/bugs/wooyun-2010-0136531 详细说明： 据说乌云已经把它列入到通用型奖励厂商当中了。 0x01 背景 AnyMacro（安宁）成立于1999年，是国内领先的统一消息/移动门户/PushMail产品与应用解决方案提供商。主要客户涵盖国家部委、大型企业以及部分海外客户，客户分布于政府、军工、金融、电信、能源、教育等行业。...

WordPress Contact Form Generator <= 2.0.1 - Multiple CSRF Vulnerabilities

Exploit for php platform in category web applications Live Demos. It is packed with a Template Creator Wizard to create fantastic forms in a matter of seconds without coding. copy of ´contactformgenerator.php´ file =================== TECHNICAL DETAILS =================== A CSRF issue was found i...

CVE-2015-2807

The CVE-2015-2807 issue affects the WordPress Navis DocumentCloud plugin, specifically versions before 0.1.1. The vulnerability resides in the js/window.php file where the wpbase parameter is used, enabling a reflected cross-site scripting (XSS) attack. An attacker can inject arbitrary script/HTM...

WordPress sourceAFRICA 0.1.3 Cross Site Scripting Vulnerability

Exploit for php platform in category web applications Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sourceafrica/ Date: 2015-08-29 Tested On : Elementary Os - Firefox Software Link...

PT-2015-5902

Name of the Vulnerable Software and Affected Versions Navis DocumentCloud plugin versions prior to 0.1.1 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter in the...

CVE-2015-2807: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in js/window.php in the Navis DocumentCloud plugin before 0.1.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wpbase parameter...

CVE-2 0 1 5-4 4 8 3: Use the feed Protocol to bypass the Firefox Mixed Content Blocker-bug warning-the black bar safety net

In Firefox 4 0. fixes a bug number for CVE-2 0 1 5-4 4 8 3 BUG. Usually Firefox can prevent the following Mixed Content mixed content: the https://mkpocapp.appspot.com/bug1148732/victim In short: the https site has a portion of the content is via the http transmission, such as resource files, etc...

WordPress sourceAFRICA 0.1.3 Cross Site Scripting

Exploit Title : Wordpress sourceAFRICA Plugin Cross Site Scripting Exploit Author : Ashiyane Digital Security Team Vendor Homepage : https://wordpress.org/plugins/sourceafrica/ Date: 2015-08-29 Tested On : Elementary Os - Firefox Software Link :...

WordPress Role Scoper Plugin <= 1.3.64 - Cross Site Scripting

Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Upgrade the plugin...

Google Chrome < 44.0.2403.157 Bypass Anti-XSS filter Vulnerability

影响版本：Google Chrome〈 44.0.2403.157 已知Google Chrome具有XSS防护机制，防止执行XSS中的的JS代码。下面有一段PHP代码：?php // Echo the value of parameter one echo "This is text1:".$GET'text1'."brbr"; // Echo the value of parameter two echo "This is text2:".$GET'text2'."brbr"; ?...

WordPress Social Locker Plugin <= 4.2.0 - Reflected Cross Site Scripting

Because of this vulnerability, authenticated administrators can inject HTML or JS code. Solution Update the plugin...

WordPress Multicons Plugin <= 2.1 - Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can store HTML or JS code in plugin configuration values. Solution Update the plugin...

WordPress Post Video Players Plugin <= 1.136 - XSS

Because of this vulnerability, authenticated users like editors can store HTML or JS code. Solution Update the plugin...

WordPress YITH Maintenance Mode Plugin <= 1.1.4 - Cross-Site Scripting

Because of this vulnerability, authenticated administrators can store HTML and JS code. Solution Update the plugin...

WordPress Crontrol Plugin <= 1.2.3 - Cross Site Scripting (XSS)

Because of this vulnerability, authenticated administrators can store HTML and JS code. Vulnerable parameters: "idhookname", "idsig", "idnextrun", "idargscode". Solution Update the plugin...