WordPress Filter Portfolio Gallery plugin cross-site request forgery vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. Filter Portfolio Gallery plugin is a WordPress open source application plugin. WordPress Filter Portfolio Gallery...

Cross site request forgery (csrf)

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery CSRF check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery...

CVE-2021-24795 Filter Portfolio Gallery <= 1.5 - Arbitrary Gallery Deletion via CSRF

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery CSRF check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery...

CVE-2021-24795

CVE-2021-24795 affects the WordPress plugin Filter Portfolio Gallery (versions

CVE-2021-24795: Cross-Site Request Forgery (CSRF)

The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery CSRF check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery...

WordPress 插件跨站请求伪造漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. Filter Portfolio Gallery plugin is a WordPress open source application plugin. WordPress Filter Portfolio Gallery...

PT-2021-16290

Name of the Vulnerable Software and Affected Versions: Filter Portfolio Gallery WordPress plugin versions 1.5 and earlier Description: The issue is related to a lack of Cross-Site Request Forgery CSRF check when deleting a Gallery. This could allow attackers to make a logged-in admin delete...

Filter Portfolio Gallery <= 1.5 - Arbitrary Gallery Deletion via CSRF

The plugin is lacking Cross-Site Request Forgery CSRF check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery. PoC https://example.com/wp-admin/admin.php?page=phoenfiltergalleryid=1...

Filter Portfolio Gallery <= 1.5 - Arbitrary Gallery Deletion via CSRF

The plugin is lacking Cross-Site Request Forgery CSRF check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery. https://example.com/wp-admin/admin.php?page=phoenfiltergallery&deleteid=1...

WordPress Filter Portfolio Gallery plugin <= 1.5 - Arbitrary Gallery Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Gallery Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Vishal Mohan in WordPress Filter Portfolio Gallery plugin versions = 1.5. Solution Deactivate and delete. This plugin has been closed as of October 7, 2021 and is not available for download. This closure is...

Copy your own portfolio to keep earning royalties

Handle jayjonah8 Vulnerability details Impact In NestedFactory.sol going through the create function which leads to the sendFeesWithRoyalties = addShares function, Im not seeing any checks preventing someone from copying their own portfolio and receiving royalty shares for it and simply repeating...

WordPress Filterable Portfolio Gallery 1.0 Plugin - (title) XSS Vulnerability

Exploit Title: WordPress Plugin Filterable Portfolio Gallery 1.0 - 'title' Stored Cross-Site Scripting XSS Exploit Author: Murat DEMIRCI @butterflyhunt3r Vendor Homepage: http://www.filterable-portfolio.com/ Software Link: https://wordpress.org/plugins/fg-gallery/ Version: 1.0 Tested on : Windows...

WordPress Filterable Portfolio Gallery 1.0 Cross Site Scripting

Exploit Title: WordPress Plugin Filterable Portfolio Gallery 1.0 - 'title' Stored Cross-Site Scripting XSS Date: 10/25/2021 Exploit Author: Murat DEMIRCI @butterflyhunt3r Vendor Homepage: http://www.filterable-portfolio.com/ Software Link: https://wordpress.org/plugins/fg-gallery/ Version: 1.0...

WordPress Plugin Filterable Portfolio Gallery 1.0 - 'title' Stored Cross-Site Scripting (XSS)

Exploit Title: WordPress Plugin Filterable Portfolio Gallery 1.0 - 'title' Stored Cross-Site Scripting XSS Date: 10/25/2021 Exploit Author: Murat DEMIRCI @butterflyhunt3r Vendor Homepage: http://www.filterable-portfolio.com/ Software Link: https://wordpress.org/plugins/fg-gallery/ Version: 1.0...

DDoS of rebalance

Handle goatbug Vulnerability details Impact Given a bondDiv of say 400, it requires 0.25% of a portfolios capital to perform a Ddos attack. Portfolio rebalancing is often a time sensitive task. New weights need to be put into place to take advantage of shifts in capital market expectations etc...

The vulnerability of the Simple Behance Portfolio WordPress plugin lies in its lack of protection for website structures, allowing attackers to inject arbitrary web scripts.

The vulnerability of the file /titan-framework/iframe-font-preview.php in the Simple Behance Portfolio WordPress plugin exists due to the lack of security measures for protecting the website structure. Exploiting this vulnerability allows a malicious actor to inject arbitrary web scripts through...

Bond div set to zero

Handle goatbug Vulnerability details Impact bondPercentDiv can be set to zero by the owner. This would give a div by zero error in line 61 bondAmount = basketToken.totalSupply / factory.bondPercentDiv; and brick any portfolio balancing ever. Proof of Concept Provide direct links to all referenced...

The vulnerability of the `get_portfolios()` and `get_portfolio_attributes()` functions in the Portfolio Responsive Gallery plugin of the WordPress content management system allows a hacker to execute arbitrary SQL code.

The vulnerability of the getportfolios and getportfolioattributes functions in the Portfolio Responsive Gallery plugin of the WordPress content management system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability could allow a remote attacker ...

Settle Portfolio state could be griefed.

Handle tensors Vulnerability details Impact It could be possible for a user to get a portfolioState that is large enough to be unfeasible to compute, either because of the block gas limit or simply because gas fees are so high and the code itself is complex. If this is possible, than he could tak...

CVE-2021-34649

The Simple Behance Portfolio WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dark parameter in the /titan-framework/iframe-font-preview.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.2...