WordPress Newsletter 4.6.0 Cross Site Request Forgery / Cross Site Scripting

Exploit for php platform in category web applications Wordpress Plugin: Newsletter 4.6.0 https://wordpress.org/plugins/newsletter/ is vulnerable to CSRF and XSS. The issue is supposed to be fixed in version 4.6.1 . See https://wordpress.org/plugins/newsletter/changelog/ for more details. 1. Store...

WordPress Newsletter 4.6.0 Cross Site Request Forgery / Cross Site Scripting

Hello, Wordpress Plugin: Newsletter 4.6.0 https://wordpress.org/plugins/newsletter/ is vulnerable to CSRF and XSS. The issue is supposed to be fixed in version 4.6.1 . See https://wordpress.org/plugins/newsletter/changelog/ for more details. 1. Stored Cross-Site Scripting XSS Authenticated...

Brave Software: [website] Script injection in newsletter signup https://brave.com/brave_youth_program_signup.html

go to https://brave.com/braveyouthprogramsignup.html click become an ambasador insert malicious payloads in the fields YOU JUST WON 1m$ you will receive a mail like in the image attached. You can send phising emails and do other bad stuff. If you need more details i'm here...

marieclaire.fr XSS vulnerability

Vulnerable URL: http://www.marieclaire.fr/newsletter.php?newsfrompopup24=%22%3E%3Cimg+src%3Dx+onerror%3Dprompt%27XSSPOSED%27%3E=1 Details: Description| Value ---|--- Patched:| Yes, at 28.07.2017 Latest check for patch:| 28.07.2017 11:30 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

thedigitel.com XSS vulnerability

Vulnerable URL: http://www.thedigitel.com/newsletter-jump.php?link=http://test.com/ Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 171944 VIP website status:| No Check thedigitel.c...

WordPress ALO EasyMail NewsLetter 2.9.2 Plugin - Cross-Site Request Forgery (Add/Import Arbitrary Su

Exploit for php platform in category web applications Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin Contact For feedback or questions about this advisory mail us at sumofpwn at securify.nl The Summer of Pwnage This issue has been found during the Summer of Pwnage hacker...

WordPress Plugin ALO EasyMail NewsLetter 2.9.2 - Cross-Site Request Forgery (AddImport Arbitrary Subscribers)

WordPress Plugin ALO EasyMail NewsLetter 2.9.2 - Cross-Site Request Forgery AddImport Arbitrary Subscribers Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin Contact For feedback or questions about this advisory mail us at sumofpwn at securify.nl The Summer of Pwnage This iss...

WordPress ALO EasyMail Newsletter 2.9.2 Cross Site Request Forgery

------------------------------------------------------------------------ Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin ------------------------------------------------------------------------ Yorick Koster, July 2016...

WordPress Plugin ALO EasyMail NewsLetter 2.9.2 - Cross-Site Request Forgery (Add/Import Arbitrary Subscribers)

Cross-Site Request Forgery in ALO EasyMail Newsletter WordPress Plugin Contact For feedback or questions about this advisory mail us at sumofpwn at securify.nl The Summer of Pwnage This issue has been found during the Summer of Pwnage hacker event, running from July 1-29. A community summer event...

kozelben.hu XSS vulnerability

Vulnerable URL: http://www.kozelben.hu/newsletter/subscribe?fullName=%5B%27%27%5D=%5B%27%27%5D%22%27%3E%20%3C/form%3E%3Cscript%3Ealert%22OPENBUGBOUNTY%22;%3C/script%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability...

WordPress ALO EasyMail NewsLetter Plugin 2.9.2 - CSRF

ALO EasyMail NewsLetter Plugin prior to 2.9.3 is prone to a cross-site request forgery CSRF. It allows remote attackers to add/import arbitrary subscribers. Solution Update ALO EasyMail NewsLetter plugin to 2.9.3 version...

Nextcloud: No captcha on newsletter.nextcloudcom leaves vulnerable to email spammers

The lack of a captcah or verificationcodeX it's empty in your phplist configuration allows attackers to use this mail for to send as much spam as they like to victims. I did not reach an email sending limit when I had tested this. PoC images below: Burp suite automated requests:...

Nextcloud: Enumeration of subscribed users and unauthenticated email unsubscriptions on https://newsletter.nextcloud.com/?p=unsubscribe

Hello, The mentioned URL contains a form that, when supplied correct user emails, unsubscribes users from the newsletters they're subscribed to. If the user is not subscribed, the form returns a message that says that the user is not subscribed if this is the case. Regards...

horn.ch XSS vulnerability

Vulnerable URL: http://www.horn.ch/newsletter/forms/optOut.asp?e=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 2996922 VIP website status:| No Check horn.ch SS...

Information Disclosure in "MMC directmail subscription" (mmc_directmail_subscription)

It has been discovered that the extension "MMC directmail subscription" mmcdirectmailsubscription is susceptible to Information Disclosure. Release Date: May 31, 2016 Component Type: Third party extension. This extension is not a part of the TYPO3 default installation. Affected Versions: 0.9.6 an...

avsforum.com XSS vulnerability

Vulnerable URL: http://www.avsforum.com/wordpress/newsletter/signup-error.php?error=Invalid%20email:%20%3Cscript%3Ealert%28%22xssposed%22%29%3C/script%3E Details: Description| Value ---|--- Patched:| Yes, at 27.07.2017 Latest check for patch:| 27.07.2017 09:11 GMT Vulnerability type:| XSS...

WordPress ALO EasyMail Newsletter Plugin Cross-Site Request Forgery Vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their weblogs on servers that support PHP and MySQL databases. A cross-site request forgery CSRF vulnerability exists in the WordPress ALO EasyMail Newsletter plugin version 2.6.01. A remote attacker can...

slashdot.org XSS vulnerability

Vulnerable URL: https://slashdot.org/newsletter Details: Description| Value ---|--- Patched:| Yes, at Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 1996 Google Pagerank| 7 VIP website status:| Yes Check slashdot.org SSL connection:| Grade: A Coordinated Disclosure...

Wordpress Newsletter Pro插件do.php文件-URL重定向漏洞

No description provided by source...

CakePHP 3.0.16, 3.1.11, and 3.2.3 Released

CakePHP 3.0.16, 3.1.11, and 3.2.3 Released The CakePHP core team is happy to announce the immediate availability of CakePHP 3.0.16, 3.1.11, and 3.2.3. These releases contain security fixes. 3.2.3 and also contains bugfixes. Security Fixes An issue in PaginatorHelper has been fixed that would allo...