Outdated php-mod/curl Library - Unauthenticated Reflected Cross-Site Scripting (XSS)

The original submission stated that the HT Slider Range for Amazon affiliates plugin for WordPress had a reflected XSS vulnerability. After investigation WPScanTeam, the cause was found to be test files from the php-mod/curl library, which was missing appropriate response headers before outputtin...

CVE-2021-3275

CVE-2021-3275 describes an unauthenticated stored cross-site scripting (XSS) affecting multiple TP-Link devices (TD-W9977v1, TL-WA801NDv5, TL-WA801Nv6, TL-WA802Nv5, Archer C3150v2). Root cause is improper sanitization in hostname handling via the vulnerable function setDefaultHostname(), with exp...

CVE-2020-14206

The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function via an arbitrary parameter...

Design/Logic Flaw

The DiveBook plugin 1.1.4 for WordPress is prone to unauthenticated XSS within the filter function via an arbitrary parameter...

CVE-2020-14206

The DiveBook WordPress plugin (version 1.1.4) is affected by an unauthenticated Cross‑Site Scripting (XSS) vulnerability in the filter function, exploitable via an arbitrary parameter. Affects: DiveBook plugin for WordPress up to 1.1.4 (no patch found per Patchstack notes); impact: potential scri...

Sell Media < 2.4.2 - Unauthenticated Reflected Cross-Site Scripting (XSS)

A Cross-site scripting XSS vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter aka $searchterm or the Search field. https://example.com/sell-media-search/?keyword="alert/XSS/...

Input validation

The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of ...

CVE-2019-19134

The Hero Maps Premium plugin 2.2.1 and prior for WordPress is prone to unauthenticated XSS via the views/dashboard/index.php p parameter because it fails to sufficiently sanitize user-supplied input. An attacker may leverage this issue to inject HTML or arbitrary JavaScript within the browser of ...

CVE-2019-19134

The CVE-2019-19134 entry concerns WordPress Hero Maps Premium plugin (versions ≤ 2.2.1) with an unauthenticated XSS via views/dashboard/index.php p parameter. The issue arises from insufficient input sanitization, enabling injection of HTML/JavaScript in a user’s browser and potentially cookie th...

CVE-2019-18881

WSO2 Identity Server as Key Manager 5.7.0 is affected by an unauthenticated reflected XSS in the dashboard user profile (CVE-2019-18881). Exploitation details are not provided in the given documents beyond this description, and no patch/version remediation is specified here. Multiple connected so...

CVE-2018-19080

An issue was discovered on Foscam Opticam i5 devices with System Firmware 1.5.2.11 and Application Firmware 2.21.1.128. The ONVIF devicemgmt SetHostname method allows unauthenticated persistent XSS...

QuantaStor Software Defined Storage 4.3.1 - Multiple Vulnerabilities

QuantaStor Software Defined Storage 4.3.1 - Multiple Vulnerabilities 1. --- Advisory details --- Title: QuantaStor Software Define Storage mmultiple vulnerabilities Advisory ID: VVVSEC-2017-6943 Advisory URL: http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt Date published:...

OSNEXUS QuantaStor 4 Information Disclosure

--- Advisory details --- Title: QuantaStor Software Define Storage mmultiple vulnerabilities Advisory ID: VVVSEC-2017-6943 Advisory URL: http://www.vvvsecurity.com/advisories/vvvsecurity-advisory-2017-6943.txt Date published: 12/08/2017 CVEs: CVE-2017-9978 "Brute force login request using http...

WPSOLR <= 8.6 - Unauthenticated Reflected Cross-Site Scripting (XSS)

The WPSOLR - Elasticsearch and Solr search WordPress plugin was affected by an Unauthenticated Reflected Cross-Site Scripting XSS security vulnerability...

Rest API XSS

An unauthenticated XSS vulnerability has been confirmed in confluence 5.8.15 and 5.8.14. The vulnerability is located at /rest/prototype/1/session/check/something POC URL: http:///confpath/rest/prototype/1/session/check/something%3Cimg%20src%3da%20onerror%3dalert%280%29%3E This was confirmed in t...

Technicolor DT5130 2.05.C29GV - Multiple Vulnerabilities

Product: Wireless N ADSL 2/2+ Modem Router Firmware Version : V2.05.C29GV Modem Type : ADSL2+ Router Modem Vendor : Technicolor Model: DT5130 Bugs: 1- Unauth Xss - CVE-2014-9142 user=teste&password=teste&...

McAfee Asset Manager 6.6 - Multiple Vulnerabilities

No description provided by source. Cloud SSO is vuln to unauthed XSS in the authentication audit form: https://twitter.com/BrandonPrry/status/445969380656943104 McAfee Asset Manager v6.6 multiple vulnerabilities http://www.mcafee.com/us/products/asset-manager.aspx Authenticated arbitrary file rea...

McAfee Asset Manager 6.6 - Multiple Vulnerabilities

McAfee Asset Manager 6.6 - Multiple Vulnerabilities Cloud SSO is vuln to unauthed XSS in the authentication audit form: https://twitter.com/BrandonPrry/status/445969380656943104 McAfee Asset Manager v6.6 multiple vulnerabilities http://www.mcafee.com/us/products/asset-manager.aspx Authenticated...

McAfee Asset Manager 6.6 - Multiple Vulnerabilities

Cloud SSO is vuln to unauthed XSS in the authentication audit form: https://twitter.com/BrandonPrry/status/445969380656943104 McAfee Asset Manager v6.6 multiple vulnerabilities http://www.mcafee.com/us/products/asset-manager.aspx Authenticated arbitrary file read An unprivileged authenticated use...

McAfee Cloud SSO / Asset Manager Issues

Cloud SSO is vuln to unauthed XSS in the authentication audit form: 2. 1. https://twitter.com/BrandonPrry/status/445969380656943104 2. 1. 2. McAfee Asset Manager v6.6 multiple vulnerabilities 3. 4. http://www.mcafee.com/us/products/asset-manager.aspx 5. 6. Authenticated arbitrary file read 7. An...