Exploit for Cross-site Scripting in Fikeulous Simpcms

Exploit Title: SimpCMS v0.1 - Cross Site Scripting XSS C...

Malicious code in down_load_ebook_se_incontri_il_buddha_per_strada_uccidilo_by_sheldon_b_kopp_0gwqq (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in down_load_ebook_maqtal_hossein_tragedin_i_karbala_by_den_vantades_vanner_4ulx6 (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in accion-devolucions-john-wick-keanu-reeves-accion-en-casa-la-mejor-neova-pelicula-publicada--en-casa-en-lienia-lliena-love (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in 5.7m-views-in-boots-the-last-wish-2023-full-online-free-on-streaming-at-home (npm)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in 1.7m-views-in-boots-the-last-wish-2023-full-online-free-on-streaming-at-home (npm)

--- -= Per source details. Do not edit below this line.=-...

WordPress Robo Gallery plugin <= 3.2.19 - Authenticated (Author+) Stored Cross-Site Scripting via Image Title vulnerability

Authenticated Author+ Stored Cross-Site Scripting via Image Title vulnerability discovered by Tim Coen in WordPress Plugin Robo Gallery versions = 3.2.19...

CVE-2024-38395

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."...

iTerm2 Security Vulnerability

iTerm2 is a terminal emulation program written for Mac OS X. A security vulnerability in iTerm2 version 3.5.x prior to 3.5.2, which originates from the unfiltered use of escape sequences to report window titles, allows an attacker to inject arbitrary code into the terminal...

CVE-2024-38395

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."...

CVE-2024-38395

CVE-2024-38395 affects iTerm2 before 3.5.2: the Terminal may report window title setting is not honored, which could allow remote code execution. Noted as not trivially exploitable. A fix is available in iTerm2 3.5.2 (see GitLab tag v3.5.2); upgrade to mitigate. The connected data also documents ...

CVE-2024-38395

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."...

PT-2024-27980 · Iterm2 · Iterm2

Name of the Vulnerable Software and Affected Versions: iTerm2 versions 3.5.x through 3.5.1 Description: An issue was discovered in iTerm2 that allows an attacker to inject arbitrary code into the terminal by abusing title reporting and tmux integration. This is possible due to the unfiltered use ...

CVE-2024-38395

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."...

CVE-2024-5858 Infographic Maker iList <= 4.7.4 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Title Update

The AI Infographic Maker plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the qcldopenaititlegeneratedesc AJAX action in all versions up to, and including, 4.7.4. This makes it possible for authenticated attackers, with Subscriber-level...

PT-2024-27891 · WordPress · Tagdiv Composer

Name of the Vulnerable Software and Affected Versions: tagDiv Composer plugin for WordPress versions up to, and including, 4.8 Description: The issue allows authenticated attackers with contributor-level and above permissions to include and execute arbitrary files on the server via the 'td block...

WordPress Infographic Maker iList plugin <= 4.7.4 - Authenticated Arbitrary Title Update vulnerability

Authenticated Arbitrary Title Update vulnerability discovered by Lucio Sá in WordPress Plugin Infographic Maker – iList versions = 4.7.4...

CVE-2024-4863

The Gutenberg Blocks with AI by Kadence WP – Page Builder Features plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the ‘titleFont’ parameter in all versions up to, and including, 3.2.38 due to insufficient input sanitization and output escaping. This makes it possible for...

AEGON LIFE v1.0 Life Insurance Management System - Stored cross-site scripting (XSS)

Exploit Title: Life Insurance Management Stored System- cross-site scripting XSS Exploit Author: Aslam Anwar Mahimkar Date: 18-05-2024 Category: Web application Vendor Homepage: https://projectworlds.in/ Software Link: https://projectworlds.in/life-insurance-management-system-in-php/ Version: AEG...

Elementor Header & Footer Builder < 1.6.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Site Title Widget

Description The Elementor Header & Footer Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the url attribute within the plugin's Site Title widget in all versions up to, and including, 1.6.35 due to insufficient input sanitization and output escaping. This makes it...