329 matches found
PT-2018-9925
Name of the Vulnerable Software and Affected Versions: Form Maker by WD plugin versions prior to 1.12.24 Description: The issue allows for CSV injection. Recommendations: For versions prior to 1.12.24, update to version 1.12.24 or later to resolve the issue...
CVE-2018-10504: Improper Neutralization of Formula Elements in a CSV File
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection...
WordPress WD #Instagram Feed Premium 1.3.0 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications WD Instagram Feed 1.3.0aaaXSS Vulnerabilities Two cross-site scripting vulnerabilities in the WD Instagram Feed WordPress plugin allow attackers to inject arbitrary web script or HTML by passing payloads through the bio of an Instagram profile...
CVE-2018-10300
Cross-site scripting XSS vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio...
Cross site scripting
Cross-site scripting XSS vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post...
CVE-2018-10301
Cross-site scripting XSS vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post...
CVE-2018-10301
CVE-2018-10301 : Cross-site scripting in the WordPress plugin WD Instagram Feed Premium (Web-Dorado) for WordPress. The vulnerability exists before version 1.3.1 and allows remote attackers to inject arbitrary script/HTML by submitting payloads in comments on an Instagram post. Impact is XSS in p...
PT-2018-9810
Name of the Vulnerable Software and Affected Versions: Web-Dorado Instagram Feed WD plugin versions prior to 1.3.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio, which is a cross-site scripting XSS...
CVE-2018-10300: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio...
CVE-2018-10301: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post...
PT-2018-2466
Name of the Vulnerable Software and Affected Versions Web-Dorado Instagram Feed WD plugin versions prior to 1.3.1 Description The issue is related to a lack of protection against web page structure manipulation. It allows a remote attacker to inject arbitrary web scripts or HTML code by passing...
CVE-2018-9148
Western Digital WD My Cloud v04.05.00-320 devices embed the session token aka PHPSESSID in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a produc...
CVE-2018-9148
Western Digital WD My Cloud v04.05.00-320 devices embed the session token aka PHPSESSID in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a produc...
CVE-2018-9148: Improper Authentication
Western Digital WD My Cloud v04.05.00-320 devices embed the session token aka PHPSESSID in filenames, which makes it easier for attackers to bypass authentication by listing a directory. NOTE: this can be exploited in conjunction with CVE-2018-7171 for remote authentication bypass within a produc...
PT-2018-18888
Name of the Vulnerable Software and Affected Versions Western Digital WD My Cloud version 04.05.00-320 Description The issue allows attackers to bypass authentication by listing a directory, as the session token aka PHPSESSID is embedded in filenames. This can be exploited in conjunction with...
Gallery WD, 1.3.9, SQL Injection
Gallery WD by Web Dorado, versions 1.3.9 and previous, SQL Injection resolution: update to 1.3.10 update notice: https://web-dorado.com/products/joomla-gallery.html...
WordPress Photo Gallery by WD plugin <=1.3.66 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability found in WordPress Photo Gallery by WD plugin versions =1.3.66. Solution Update the WordPress Photo Gallery by WD plugin to the latest available version at least 1.3.67...
Photo Gallery by WD <= 1.3.66 - Cross-Site Scripting (XSS)
User input gets first escaped with eschtml and then urldecoded. This leads to the possibility of reflected XSS with a double url encoded payload...
Photo Gallery by WD <= 1.3.66 - Cross-Site Scripting (XSS)
User input gets first escaped with eschtml and then urldecoded. This leads to the possibility of reflected XSS with a double url encoded payload. PoC...