SA-CONTRIB-2014-005 - Leaflet - Access bypass

The Leaflet module enables you to display an interactive map using the Leaflet library, using entities as map features. The module exposes complete data from entities used as map features to any site visitor with a Javascript inspector like Firebug. CVE identifiers issued ACVE identifier will be...

Wordpress Plugins - leaflet maps marker Blind SQL Injection Vulnerability

Exploit for php platform in category web applications ================================================================================ || | | || || || |/ | || |/ | | | | | | | | | | | \ | | | | \ ================================================================================ Exploit Title:...

CVE-2012-2913

Multiple cross-site scripting XSS vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 leafletlayer.php or 2 leafletmarker.php, as reachable through wp-admin/admin.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 leafletlayer.php or 2 leafletmarker.php, as reachable through wp-admin/admin.php...

CVE-2012-2913

Multiple cross-site scripting XSS vulnerabilities in the Leaflet plugin 0.0.1 for WordPress allow remote attackers to inject arbitrary web script or HTML via the id parameter to 1 leafletlayer.php or 2 leafletmarker.php, as reachable through wp-admin/admin.php...

CVE-2012-2913

The CVE-2012-2913 entry concerns the Leaflet Maps Marker WordPress plugin (version 0.0.1) where unsanitized input in the id parameter (used by leaflet_layer.php and leaflet_marker.php via wp-admin/admin.php) enables cross-site scripting (XSS). Root cause: improper input handling in the id field l...

WordPress Plugin Leaflet Maps Marker 0.0.1 - leaflet_layer.php?id Cross-Site Scripting

WordPress Plugin Leaflet Maps Marker 0.0.1 - leafletlayer.php?id Cross-Site Scripting source: https://www.securityfocus.com/bid/53526/info The Leaflet plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may...

WordPress Leaflet 0.0.1 Cross Site Scripting

Hi We have used our tool, THAPS, to identify vulnerabilities in this WordPress plugin. We have confirmed at least one of the reported vulnerabilities and created a working exploit located below. Attached is one or more log files containing the output of our tool, identifying the location of the...

WordPress Leaflet Maps Marker Plugin 0.0.1 - "id" Parameter XSS

WordPress Leaflet Maps Marker plugin's "id" parameter is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can stea...

Leaflet <= 0.0.1 - Cross Site Scripting

Plugin is still affected and has been closed...

WordPress Plugin Leaflet Maps Marker 0.0.1 - leaflet_marker.php?id Cross-Site Scripting

WordPress Plugin Leaflet Maps Marker 0.0.1 - leafletmarker.php?id Cross-Site Scripting source: https://www.securityfocus.com/bid/53526/info The Leaflet plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may...

WordPress Plugin Leaflet Maps Marker 0.0.1 - 'leaflet_layer.php?id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/53526/info The Leaflet plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...

WordPress Plugin Leaflet Maps Marker 0.0.1 - 'leaflet_marker.php?id' Cross-Site Scripting

source: https://www.securityfocus.com/bid/53526/info The Leaflet plugin for WordPress is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting...