Server side request forgery (ssrf)

Server-side request forgery SSRF in the Import XML and RSS Feeds import-xml-feed plugin 2.0.1 for WordPress via the data parameter in a moovereadxml action...

CVE-2020-24148

The CVE-2020-24148 entry is concrete: WordPress Import XML and RSS Feeds (import-xml-feed) plugin is affected up to version 2.0.1. The flaw is a server-side request forgery (SSRF) via the data parameter in the moove_read_xml action, implemented when the plugin fetches a URL using data as input (v...

CVE-2020-24148

Server-side request forgery SSRF in the Import XML and RSS Feeds import-xml-feed plugin 2.0.1 for WordPress via the data parameter in a moovereadxml action...

IkaIka RSS Reader Cross-Site Scripting Vulnerability

IkaIka RSS Reader is an online RSS reader. A cross-site scripting vulnerability exists in IkaIka RSS Reader that stems from insufficient filtering of user-supplied data in RSS feeds. A remote attacker could trick a victim into visiting a specially crafted link in a vulnerable website and execute...

CVE-2021-20752

Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary script via unspecified vectors...

Cross site scripting

Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary script via unspecified vectors...

CVE-2021-20752

Cross-site scripting vulnerability in IkaIka RSS Reader all versions allows a remote attacker to inject an arbitrary script via unspecified vectors...

CVE-2021-20752

CVE-2021-20752 is a cross-site scripting vulnerability affecting IkaIka RSS Reader (all versions). The issue arises from insufficient filtering of user-supplied data in RSS feeds, allowing a remote attacker to cause arbitrary script execution in the victim’s browser when a vulnerable feed is proc...

IkaIka RSS Reader vulnerable to cross-site scripting

Overview IkaIka RSS Reader contains a cross-site scripting vulnerability CWE-79, due to the improper processing of RSS registration. LAC Co., Ltd. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact If a malicio...

IkaIka RSS Reader 跨站脚本漏洞

IkaIka RSS Reader is an online RSS reader. A cross-site scripting vulnerability exists in IkaIka RSS Reader that stems from insufficient filtering of user-supplied data in RSS feeds. A remote attacker could trick a victim into visiting a specially crafted link in a vulnerable website and execute...

JVN#15185184: IkaIka RSS Reader vulnerable to cross-site scripting

IkaIka RSS Reader contains a cross-site scripting vulnerability CWE-79, due to the improper processing of RSS registration. Impact If a malicious RSS feed is loaded into the product, an arbitrary script may be executed on the web browser where the product is running. Solution Do not use IkaIka RS...

Plan managed by specs allows to modify artifact dependencies with UI

h3. Issue Summary RSS-managed plan should be in View mode for every tab and page. h3. Steps to Reproduce Create plan managed by RSS with artifact subscription settings Open Plan config page and visit artifacts tab of job Click Edit or Delete button of artifact subscription item h3. Expected Resul...

Plan managed by specs allows to modify artifact dependencies with UI

h3. Issue Summary RSS-managed plan should be in View mode for every tab and page. h3. Steps to Reproduce Create plan managed by RSS with artifact subscription settings Open Plan config page and visit artifacts tab of job Click Edit or Delete button of artifact subscription item h3. Expected Resul...

CVE-2021-24277 RSS for Yandex Turbo < 1.30 - Authenticated Stored Cross-Site Scripting (XSS)

The RSS for Yandex Turbo WordPress plugin before 1.30 did not properly sanitise the user inputs from its Счетчики settings tab before outputting them back in the page, leading to authenticated stored Cross-Site Scripting issues...

Brave Software: XSS on Brave Today through custom RSS feed

A vulnerability was discovered in Brave iOS's custom RSS feed feature that allowed for cross-site scripting XSS attacks. Attackers could add a malicious RSS feed containing a javascript: URL, which could execute arbitrary code when a user clicked on a link in Brave Today. The vulnerability was...

WordPress RSS for Yandex Turbo plugin <= 1.29 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Himamshu Dilip Kulkarni in WordPress RSS for Yandex Turbo plugin versions = 1.29. Solution Update the WordPress RSS for Yandex Turbo plugin to the latest available version at least 1.30...

WordPress RSS For Yandex Turbo 1.29 Cross Site Scripting

Exploit Title: WordPress Plugin RSS for Yandex Turbo 1.29 - Stored Cross-Site Scripting XSS Date: 17/04/2021 Exploit Author: Himamshu Dilip Kulkarni Software Link: https://wordpress.org/plugins/rss-for-yandex-turbo/ Version: 1.29 Tested on: Windows Steps to reproduce vulnerability: 1. Install...

WordPress Plugin RSS for Yandex Turbo 1.29 - Stored Cross-Site Scripting (XSS)

Exploit Title: WordPress Plugin RSS for Yandex Turbo 1.29 - Stored Cross-Site Scripting XSS Date: 17/04/2021 Exploit Author: Himamshu Dilip Kulkarni Software Link: https://wordpress.org/plugins/rss-for-yandex-turbo/ Version: 1.29 Tested on: Windows Steps to reproduce vulnerability: 1. Install...

Import XML and RSS Feeds < 2.0.3 - Authenticated Server-side Request Forgery (SSRF)

The plugin is affected by a Server-side request forgery SSRF vulnerability via the data parameter in a moovereadxml action...

Tiny Tiny RSS Remote Code Execution (CVE-2020-25787)

A remote code execution vulnerability exists in Tiny Tiny RSS. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary code on the affected system...