123ContactForm for WordPress <= 1.5.6 - Unauthenticated Arbitrary Post Creation

Description The cfp-new-post AJAX action uses the cfpauthenticate function to attempt to verify the signature, however uses user controller input to do so which result in a bypass, then allowing unauthenticated attackers to create arbitrary posts...

WordPress 123ContactForm plugin <= 1.5.6 - Arbitrary Post Creation vulnerability

Arbitrary Post Creation vulnerability found by Sucuri in WordPress 123ContactForm plugin versions = 1.5.6. Solution 2021-01-20 - we were unable to find a patched version of this plugin. Notification from WordPress plugin repository: "This plugin has been closed as of October 27, 2020 and is not...

Cross-Site Scripting (XSS)

anchorcms/anchor-cms is vulnerable to cross-site scripting XSS. A user with a privilege to login as administrator is allowed to post arbitrary script via the post creation feature which will execute in a user's browser when visited...

WordPress IMPress for IDX Broker plugin <= 2.6.1 - Authenticated Post Creation, Modification, and Deletion vulnerability

Authenticated Post Creation, Modification, and Deletion vulnerability discovered by WordFence in WordPress IMPress for IDX Broker plugin versions = 2.6.1. Solution Update the WordPress IMPress for IDX Broker plugin to the latest available version at least 2.6.2...

IMPress for IDX Broker < 2.6.2 - Authenticated Post Creation, Modification, and Deletion

This plugin registers 2 AJAX actions intended to create and delete "dynamic pages," intended to ensure that any IDX pages match the site’s style and branding. Neither of the functions called by these AJAX actions used capability checks or nonce checks. As such it was possible for an authenticated...

VulnCheck KEV: CVE-2020-9514

An issue was discovered in the IMPress for IDX Broker plugin before 2.6.2 for WordPress. wrappers.php allows a logged-in user with the Subscriber role to permanently delete arbitrary posts and pages, create new posts with arbitrary subjects, and modify the subjects of existing posts and pages...

Rockstar Games: CSRF Vulnerability on post creation page /community/create-post.json

In this report the researcher demonstrated how to exploit a CSRF vulnerability on the impacted endpoint. This would allow a remote attacker to spam the community boards as other users. This attack only worked in Chrome browsers. A recent update to Chrome changed how cross-origin requests are...

WordPress Multiple Vulnerabilities (Dec 2018) - Linux

WordPress is prone to multiple vulnerabilities. Copyright C 2018 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

WordPress 5.0 Patched to Fix Serious Bugs

WordPress 5.0 users are being urged to update their CMS software to fix a number of serious bugs. The update WordPress 5.0.1 addresses seven flaws and was issued Thursday, less than a week after WordPress 5.0 was released. The most serious of the flaws is a bug that allows the WordPress “user...

WordPress: Logic flaw in the Post creation process allows creating posts with arbitrary types without needing the corresponding nonce

Simon discovered that authors could create posts of unauthorized post types with specially crafted input fixed. This was fixed in the 5.0.1 release, and Simon has published more details on his blog...

Discuz! DiscuzX cross-site scripting vulnerability (CNVD-2018-08776)

Discuz! DiscuzX is an online forum system. A cross-site scripting vulnerability exists in Discuz! DiscuzX X3.4 and previous versions. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML with the help of forum.php?mod=post&action=newthread...

YouTube Automated CMS 1.0.7 - Cross-Site Request Forgery / Persistent Cross-Site Scripting

Exploit Title: YouTube Automated CMS 1.0.1 / 1.0.7 - CSRF to Persistent XSS Date: 14 October 2016 Exploit Author: Arbin Godar Website : ArbinGodar.com Software Link: https://codecanyon.net/item/youtube-automated-cms/12021939 Version: 1.0.1 to 1.0.7...

WordPress Advanced Video 1.0 Local File Inclusion

!/usr/bin/env python Exploit Title: Advanced-Video-Embed Arbitrary File Download / Unauthenticated Post Creation Google Dork: N/A Date: 04/01/2016 Exploit Author: evait security GmbH Vendor Homepage: arshmultani - http://dscom.it/ Software Link:...

WordPress Plugin Advanced Video 1.0 - Local File Inclusion

WordPress Plugin Advanced Video 1.0 - Local File Inclusion !/usr/bin/env python Exploit Title: Advanced-Video-Embed Arbitrary File Download / Unauthenticated Post Creation Google Dork: N/A Date: 04/01/2016 Exploit Author: evait security GmbH Vendor Homepage: arshmultani - http://dscom.it/ Softwar...

Nibbleblog Cross-Site Request Forgery Vulnerability

NibbleBlog is a set of blogging engines. A cross-site request forgery vulnerability exists in Nibbleblog versions prior to 4.0.3 due to an admin.php script that fails to adequately filter newsimple operations and filter the 'content' parameter in newsimple operations. A remote attacker can exploi...

CVE-2015-6966

Multiple cross-site request forgery CSRF vulnerabilities in Nibbleblog before 4.0.5 allow remote attackers to hijack the authentication of administrators for requests that 1 create a post via a newsimple action to admin.php or 2 conduct cross-site scripting XSS attacks via the content parameter i...

Yii Framework Blog Cross Site Request Forgery

Exploit Title: Yii Framework Blog Application CSRF Vulnerability Date: 3 Mar 2014 Author: Christy Philip Mathew Demo: Yii Blog Application - http://www.yiiframework.com/demos/blog/ Category:: web Tested on: Windows 8 Attacker will be able to create a post...

Cross site scripting

Cross-site scripting XSS vulnerability in vBulletin 4.1.12 allows remote attackers to inject arbitrary web script or HTML via a long string in the subject parameter when creating a post...

CVE-2009-4801

EZ-Blog Beta 1 does not require authentication, which allows remote attackers to create or delete arbitrary posts via requests to PHP scripts...

Light Blog Multiple Vulnerabilities Exploit

No description provided by source. !/usr/bin/php -q -d shortopentag=on ? echo "\r\n"; echo "Light Blog Multiple Vulnerabilities Exploit\r\n"; echo "by BlackHawk [email protected]\r\n"; echo "Thanks to rgod for the php code and Marty for the Love\r\n\r\n"; if $argc4 echo "Usage: php ".$argv0."...