CVE-2017-16629: Generation of Error Message Containing Sensitive Information

In SapphireIMS 40971, it is possible to guess the registered/active usernames of the software from the errors it gives out for each type of user on the Login form. For "Incorrect User" - it gives an error "The application failed to identify the user. Please contact administrator for help." For...

CVE-2021-34628

The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the /includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7...

WordPress 插件 跨站请求伪造漏洞

WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in the WordPress plugin admin-custom-login, which stems from the fact that the Admin Custom Login WordPress plugin is susceptible to cross-site request forgery attacks due to the loginbgSave found...

PT-2021-20595

Name of the Vulnerable Software and Affected Versions: Admin Custom Login WordPress plugin versions up to and including 3.2.7 Description: The issue is related to Cross-Site Request Forgery, allowing attackers to inject arbitrary web scripts due to the loginbgSave action found in the...

CVE-2021-34628: Cross-Site Request Forgery (CSRF)

The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the /includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7...

Admin Custom Login < 3.2.8 - CSRF to Stored XSS

The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the /includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7. PoC...

CVE-2021-24406

The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control...

Open redirect

The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control...

CVE-2021-24406

The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control...

CVE-2021-24406

The WordPress wpForo Forum plugin (versions prior to 1.9.7) has an open redirect vulnerability in the login form caused by not validating the redirect_to parameter. This can allow an attacker to redirect users to a malicious site after login, potentially enabling credential exposure or phishing. ...

CVE-2021-24406 wpForo Forum < 1.9.7 - Open Redirect

The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control...

PT-2021-15939

Name of the Vulnerable Software and Affected Versions wpForo Forum WordPress plugin versions prior to 1.9.7 Description The issue is related to an open redirect problem after a successful login, caused by the lack of validation of the redirect to parameter in the login form of the forum. This cou...

CVE-2021-24406: URL Redirection to Untrusted Site

The wpForo Forum WordPress plugin before 1.9.7 did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control...

wpForo Forum < 1.9.7 - Open Redirect

The plugin did not validate the redirectto parameter in the login form of the forum, leading to an open redirect issue after a successful login. Such issue could allow an attacker to induce a user to use a login URL redirecting to a website under their control and being a replica of the legitimat...

Spotweb 1.4.9 - DOM Based Cross-Site Scripting (XSS)

Exploit Title: Spotweb 1.4.9 - DOM Based Cross-Site Scripting XSS Exploit Author: @nu11secur1ty Date: 05.20.2021 Software Link: https://github.com/spotweb/spotweb Proof: https://streamable.com/hix5o1 + Exploit Source: !/usr/bin/python3 Author: @nu11secur1ty from selenium import webdriver import...

PT-2021-15759

Name of the Vulnerable Software and Affected Versions: OpenID Connect Generic Client WordPress plugin versions 3.8.0 through 3.8.1 Description: The issue is related to a reflected Cross-Site Scripting problem. It occurs because the login error is not properly sanitized when output back in the log...

CVE-2021-24214: Improper Neutralization of Input During Web Page Generation

The OpenID Connect Generic Client WordPress plugin 3.8.0 and 3.8.1 did not sanitise the login error when output back in the login form, leading to a reflected Cross-Site Scripting issue. This issue does not require authentication and can be exploited with the default configuration...

CVE-2021-24228

The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of...

Cross site scripting

The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of...

CVE-2021-24228

The Jetpack Scan team identified a Reflected Cross-Site Scripting in the Login Form of the Patreon WordPress plugin before 1.7.2. The WordPress login form wp-login.php is hooked by the plugin and offers to allow users to authenticate on the site using their Patreon account. Unfortunately, some of...