WordPress cp-contact-form-with-paypal plugin SQL injection vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site. cp-contact-form-with-paypal aka CP Contact Form with PayPal plugin is one of the payment plugins. A SQL injection...

Cross site request forgery (csrf)

The cp-contact-form-with-paypal aka CP Contact Form with PayPal plugin before 1.1.6 for WordPress has CSRF with resultant XSS, related to cpcontactformpp.php and cpcontactformppadminintlist.inc.php...

CVE-2015-9234

The cp-contact-form-with-paypal aka CP Contact Form with PayPal plugin before 1.1.6 for WordPress has SQL injection via the cpcontactformppid parameter to cpcontactformpp.php...

CVE-2015-9233

The CP Contact Form with PayPal WordPress plugin (pre-1.1.6) is affected by a CSRF vulnerability that can lead to Cross-Site Scripting (XSS), related to cp_contactformpp.php and cp_contactformpp_admin_int_list.inc.php. Affected versions are prior to 1.1.6; updating to 1.1.6 or later is the docume...

CVE-2015-9234

The cp-contact-form-with-paypal aka CP Contact Form with PayPal plugin before 1.1.6 for WordPress has SQL injection via the cpcontactformppid parameter to cpcontactformpp.php...

AlegroCart SQL Injection Vulnerability

AlegroCart is an open source online business solution from the Canadian ALEGROCART team. A SQL injection vulnerability exists in AlegroCart version 1.2.8. Remote attackers can use a variety of methods to exploit the vulnerability to execute arbitrary SQL commands. The methods include:...

CVE-2015-9226

Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the 1 checkdownload and possibly 2 checkfilename function in upload/admin2/model/products/modeladmindownload.php or remote authenticated users wit...

Sql injection

Multiple SQL injection vulnerabilities in AlegroCart 1.2.8 allow remote administrators to execute arbitrary SQL commands via the download parameter in the 1 checkdownload and possibly 2 checkfilename function in upload/admin2/model/products/modeladmindownload.php or remote authenticated users wit...

Blizzard Entertainment Hit With Weekend DDoS Attack

Blizzard Entertainment reported a crippling DDoS attack over the weekend creating chronic latency and connection issues for players of games Overwatch, World of Warcraft and others. The DDoS attack has since subsided, according to Blizzard, but users are still grousing on Twitter over lingering...

Paypal bypass email verify logins Vulnerability

Bypass verification on paypal email verify logins. Usage Info just use the web This is private exploit. You can buy it at https://0day.today...

decor.io XSS vulnerability

Vulnerable URL: https://decor.io/site/fb-page-151152128416048/dsf/services/ResourceProvider?handler=paypal=eyJwYXRoIjoiL3RhYl8yNTY1Nzk1MTEwNjM3NzciLCJ2ZXJzaW9uSWQiOiJ2MTg5NTg0NDQyIn0-=l512311914=151152128416048...

Automattic: Object Injection in Woocommerce / Handle PDT Responses from PayPal

At this moment prevention from object injection is in the following line of code: pregmatch '/^a:2:/', $rawcustom && ! pregmatch '/CO:+?0-9+:"/', $rawcustom && $custom = maybeunserialize $rawcustom but the PHP native unserialize function supports little o as option in it and it is a StdClass...

PayPal Marketing User Enumeration

Document Title: =============== PayPal Inc BB 149 - Gift Insufficient Authentication Vulnerability References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1973 ID EIBBP-34368 Release Date: ============= 2017-06-21 Vulnerability Laboratory ID VL-ID:...

PayPal Inc BB #149 - (Gift) Insufficient Authentication

Document Title: =============== PayPal Inc BB 149 - Gift Insufficient Authentication References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1973 ID EIBBP-34368 Release Date: ============= 2017-06-21 Vulnerability Laboratory ID VL-ID:...

PayPal Inc BB #149 - (Gift) Insufficient Authentication

Document Title: =============== PayPal Inc BB 149 - Gift Insufficient Authentication References Source: ==================== https://www.vulnerability-lab.com/getcontent.php?id=1973 ID EIBBP-34368 Release Date: ============= 2017-06-20 Vulnerability Laboratory ID VL-ID:...

Following the Money Hobbled vDOS Attack-for-Hire Service

A new report proves the value of following the money in the fight against dodgy cybercrime services known as "booters" or "stressers" -- virtual hired muscle that can be rented to knock nearly any website offline. Last fall, two 18-year-old Israeli men were arrested for allegedly running vDOS,...

Multiple Cross-Site Request Forgery Vulnerabilities in Simple Invoices

Simple Invoices is an open source, free web-based invoicing system. Three cross-site request forgery vulnerabilities exist in Simple Invoices version 2013.1.beta.8. A remote attacker can use these vulnerabilities to create a new administrator user account and take control of the entire applicatio...

CVE-2017-8930

Multiple cross-site request forgery CSRF vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can 1 create new administrator user accounts and take over the entire application, 2 create regular user accounts, or 3 change...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can 1 create new administrator user accounts and take over the entire application, 2 create regular user accounts, or 3 change...

CVE-2017-8930

Multiple cross-site request forgery CSRF vulnerabilities in Simple Invoices 2013.1.beta.8 allow remote attackers to hijack the authentication of admins for requests that can 1 create new administrator user accounts and take over the entire application, 2 create regular user accounts, or 3 change...