213 matches found
CVE-2021-24468 Leaflet Map < 3.0.0 - Contributor+ Stored XSS
The Leaflet Map WordPress plugin before 3.0.0 does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues...
CVE-2021-24468
CVE-2021-24468 affects the WordPress Leaflet Map plugin up to version 3.0.0, where shortcode attributes are not escaped before use in JavaScript/HTML, enabling stored XSS by users with as low as Contributor. Impact is stored XSS; remediation is to update to v3.0.0 or newer (per provided records).
WordPress 插件跨站脚本漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists i...
Leaflet Map < 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSS
The plugin does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the JavaScript library being used, or usin...
Leaflet Map < 3.0.0 - Contributor+ Stored XSS
The plugin does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues PoC Most of the shortcode attributes are not escaped, so these are just one of them: leaflet-map...
Leaflet Map < 3.0.0 - Arbitrary Settings Update via CSRF Leading to Stored XSS
The plugin does not verify the CSRF nonce when saving its settings, which allows attackers to make a logged in admin update the settings via a Cross-Site Request Forgery attack. This could lead to Cross-Site Scripting issues by either changing the URL of the JavaScript library being used, or usin...
Leaflet Map < 3.0.0 - Contributor+ Stored XSS
The plugin does not escape some shortcode attributes before they are used in JavaScript code or HTML, which could allow users with a role as low as Contributors to exploit stored XSS issues Most of the shortcode attributes are not escaped, so these are just one of them: leaflet-map...
WordPress Leaflet Map plugin <= 2.23.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by apple502j in WordPress Leaflet Map plugin versions = 2.23.3. Solution Update the WordPress Leaflet Map plugin to the latest available version at least 3.0.0...
GHSA-GJC9-932X-C59P Malicious Package in leaflet-gpx
Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate yo...
Malicious Package in leaflet-gpx
Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and evaluate yo...
@here/harp-leaflet (>=0.2.4 <=0.2.5) potentially affected by CVE-2020-8244 via bl (=4.0.2)
bl NPM version =4.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on bl and may be impacted: - @here/harp-leaflet =0.2.4, =0.2.5 Source cves: CVE-2020-8244 Source advisory: OSV:GHSA-PP7H-53GX-MX7R...
Man-in-the-Middle (MitM)
com.liferay.map.openstreetmap is vulnerable to man-in-the-middle attacks. The bundle loads the npm package leaflet using HTTP instead of HTTPS. This allows an attacker to perform a man-in-the-middle attack to modify the package contents...
Malicious Package
Overview Version 1.0.1 of leaflet-gpx contained malicious code. The code when executed in the browser would enumerate password, cvc and cardnumber fields from forms and send the extracted values to https://js-metrics.com/minjs.php?pl= Recommendation Remove the package from your environment and...
Typo3 CMS BrowserMaps Leaflet Tutorial tx_browser_pi1 8.0.39 SQL Injection
Exploit Title : Typo3 CMS BrowserMaps Leaflet Tutorial txbrowserpi1 8.0.39 SQL Injection Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 18/02/2019 Vendor Homepage : typo3-organiser.de typo3.org Software Download Links :...
WordPress Leaflet Maps Marker Plugin <= 3.5.3 - SQL Injection
This plugin is prone to tag multiple parameter SQL injection. Solution Upgrade the plugin...
WordPress Leaflet Maps Marker Plugin <= 2.3 - Multipe Vulnerabilities
This plugin is prone to multiple security issues. Solution Update the plugin...
WordPress Leaflet Maps Marker Pro Plugin - Multiple Vulnerabilities
This plugin is prone to SQL injection, cross site scripting, shell upload and file deletion vulnerabilities. Solution Update the plugin...
Leaflet Maps Marker 3.5.2 - Two SQL Injection Vulnerabilities
The Leaflet Maps Marker Google Maps, OpenStreetMap, Bing Maps WordPress plugin was affected by a Two SQL Injection Vulnerabilities security vulnerability...