CVE-2022-4031 Simple:Press <= 6.8 - Authenticated (Admin+) Path Traversal to Arbitrary File Modification

The Simple:Press plugin for WordPress is vulnerable to arbitrary file modifications in versions up to, and including, 6.8 via the 'file' parameter which does not properly restrict files to be edited in the context of the plugin. This makes it possible with attackers, with high-level permissions...

CVE-2022-4030

The Simple:Press plugin for WordPress is vulnerable to Path Traversal in versions up to, and including, 6.8 via the 'file' parameter which can be manipulated during user avatar deletion. This makes it possible with attackers, with minimal permissions such as a subscriber, to supply paths to...

CVE-2022-4030

The CVE-2022-4030 entry concerns the WordPress Simple:Press plugin (versions up to 6.8). It describes a path-traversal flaw in the file parameter used during user avatar deletion, which could allow an attacker with minimal privileges (e.g., a subscriber) to reference and delete arbitrary server f...

CVE-2022-4029

CVE-2022-4029 affects the WordPress Simple:Press plugin up to version 6.8. The vulnerability is a Reflected Cross-Site Scripting via the cookie value named like sforum_[md5 hash of the WordPress URL], caused by insufficient input sanitization and output escaping. This enables unauthenticated atta...

CVE-2022-4028

The CVE-2022-4028 describes a Stored XSS vulnerability in the WordPress Simple:Press plugin (up to and including version 6.8) triggered by the postitem parameter during profile-signature modification. Root cause: insufficient input sanitization and output escaping enables injection of object/embe...

CVE-2022-4027

The CVE-2022-4027 entry concerns the WordPress Simple:Press plugin (versions up to 6.8) with a stored XSS vulnerability in the forum reply flow via the postitem parameter. The root cause is insufficient input sanitization and output escaping, allowing injection of object/embed tags. Unauthenticat...

WordPress plugin Simple:Press 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An arbitrary file...

PT-2022-25325 · WordPress · Simple:Press

Name of the Vulnerable Software and Affected Versions: Simple:Press plugin for WordPress versions up to, and including, 6.8 Description: The issue is related to Reflected Cross-Site Scripting via the sforum md5 hash of the WordPress URL cookie value due to insufficient input sanitization and outp...

Simple:Press < 6.8.1 - Subscriber+ Stored XSS via Profile Signatures

The plugin does not sanitise and escape the postitem parameter when modifying profile signatures, which could allow any authenticated users, such as subscriber to perform Stored XSS attacks...

PT-2022-25312 · WordPress · Simple:Press

Name of the Vulnerable Software and Affected Versions: Simple:Press plugin for WordPress versions up to, and including, 6.8 Description: The issue concerns Stored Cross-Site Scripting via the postitem parameter manipulated during a forum response. This is due to insufficient input sanitization an...

PT-2022-25342 · WordPress · Simple:Press

Name of the Vulnerable Software and Affected Versions: Simple:Press plugin for WordPress versions up to, and including, 6.8 Description: The issue allows for arbitrary file modifications via the file parameter, which does not properly restrict files to be edited in the context of the plugin. This...

Simple:Press < 6.8.1 - Admin+ Arbitrary File Update

The plugin does not validate files to be updated, which could allow high privilege users such as admin to update arbitrary files and not just the one allowed by the plugin...

Simple:Press < 6.8.1 - Unauthenticated Stored XSS via Forum Replies

The plugin does not sanitise and escape the postitem parameter when posting a forum reply, which could allow unauthenticated users to perform Stored XSS attacks...

Simple:Press < 6.6.1 - Broken Access Control leading to RCE

Jerome Bruandet, from NinTechNet, discovered a broken access control issue in the plugin, which could lead to unauthenticated arbitrary file and RCE...

WordPress Simple:Press <= 6.6.0 - Broken Access Control leading to RCE vulnerability

Broken Access Control leading to RCE vulnerability found by Jerome Bruandet NinTechNet in WordPress Simple:Press versions = 6.6.0. Solution Update the WordPress Simple:Press plugin to the latest available version at least 6.6.1...

WordPress Plugin Simple:Press Forum - Arbitrary File Upload

WordPress Plugin Simple:Press Forum - Arbitrary File Upload source: https://www.securityfocus.com/bid/55243/info The Simple:Press Forum plugin is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplie...

WordPress Plugin Simple:Press Forum - Arbitrary File Upload

source: https://www.securityfocus.com/bid/55243/info The Simple:Press Forum plugin is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker may leverage this issue to upload...

TinyMCE / flvPlayer Cross Site Scripting / Disclosure

No description provided by source. I want to warn you about multiple vulnerabilities in TinyMCE and flvPlayer and hundreds of web applications and tens millions of web sites. These are Full path disclosure, Content Spoofing and Cross-Site Scripting vulnerabilities in TinyMCE CS and XSS are in...

Multiple vulnerabilities in TinyMCE and flvPlayer and hundreds of web applications

Hello 3APA3A! I want to warn you about multiple vulnerabilities in TinyMCE and flvPlayer and hundreds of web applications and tens millions of web sites. These are Full path disclosure, Content Spoofing and Cross-Site Scripting vulnerabilities in TinyMCE CS and XSS are in flvPlayer, which is...

TinyMCE / flvPlayer Cross Site Scripting / Disclosure

Hello list! I want to warn you about multiple vulnerabilities in TinyMCE and flvPlayer and hundreds of web applications and tens millions of web sites. These are Full path disclosure, Content Spoofing and Cross-Site Scripting vulnerabilities in TinyMCE CS and XSS are in flvPlayer, which is includ...