CVE-2021-24620

The CVE-2021-24620 issue affects WordPress Simple Ecommerce Shopping Cart Plugin (versions

CVE-2021-24390

A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection...

CVE-2021-24390

A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection...

CVE-2021-24390

A proid GET parameter of the WordPress支付宝Alipay|财付通Tenpay|贝宝PayPal集成插件 WordPress plugin through 3.7.2 is not sanitised, properly escaped or validated before inserting to a SQL statement not delimited by quotes, leading to SQL injection...

CVE-2021-24390

The CVE-2021-24390 entry corresponds to an authenticated SQL injection in the WordPress Alipay plugin (versions up to 3.7.2). The vulnerability stems from the proid GET parameter not being properly sanitised/escaped/validated before being interpolated into an SQL statement, enabling an attacker w...

CVE-2021-24478

The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24478

The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue...

Cross site scripting

The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24478

The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue...

CVE-2021-24478

CVE-2021-24478 concerns the WordPress Bookshelf plugin (versions up to and including 2.0.4). The vulnerability is an authenticated stored XSS arising from the plugin failing to sanitize or escape the “Paypal email address” setting before it is output on a page. Several sources (NVD, CVE listings,...

WordPress 插件 跨站脚本漏洞

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.Bookshelf plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in the Bookshelf...

Bookshelf <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue PoC Add the following payload in the "Paypal email address" setting of the plugin /wp-admin/admin.php?page=bookshelf-settings: ...

Bookshelf <= 2.0.4 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue Add the following payload in the "Paypal email address" setting of the plugin /wp-admin/admin.php?page=bookshelf-settings:...

Reddit: IDOR to pay less for coin purchases on oauth.reddit.com via /api/v2/gold/paypal/create_coin_purchase_order in `order_id` parameter

Summary: This vulnerability consist of modifying the PayPal transaction ID to buy a big coin pack but paying the small price for it. Impact: The only impact here could be that you don't earn the money you deserve, and users can offer a lot of presents to other users, breaking the magic of the...

Twitter's Tip Jar Privacy Fiasco Was Entirely Avoidable

Sending its users to PayPal has created all sorts of problems that Twitter should have caught ahead of time...

Leaky database exposes fake Amazon product reviews scam

By Deeba Ahmed The database contained 7GB worth of data including fake Amazon reviews and PayPal email addresses of scammers among other sensitive data. This is a post from HackRead.com Read the original post: Leaky database exposes fake Amazon product reviews scam...

Moderate: Red Hat Security Advisory: nss security and bug fix update

An update for nss is now available for Red Hat Enterprise Linux 7. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CV...

RHEL 7 : nss (RHSA-2021:1384)

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2021:1384 advisory. Network Security Services NSS is a set of libraries designed to support the cross-platform development of security-enabled client and server...

CopperStealer Malware Targets Facebook and Instagram Business Accounts

A malware that until now has gone undocumented has been quietly hijacking online accounts of advertisers and users of Facebook, Apple, Amazon, Google and other web giants since July 2019 and then using them for nefarious activity, researchers have found. Dubbed CopperStealer, the malware acts...

Gitlab-Watchman - Monitoring GitLab For Sensitive Data Shared Publicly

GitLab Watchman is an application that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally. Features It searches GitLab for internally shared projects and looks at: Code Commits Wiki pages Issues Merge requests Milestones For the following data: GCP keys and...