CVE-2021-24615

The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks...

CVE-2021-24615

The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks...

Cross site scripting

The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks...

CVE-2021-24615

The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks...

CVE-2021-24615 Wechat Reward <= 1.7 - CSRF to Stored Cross-Site Scripting

The Wechat Reward WordPress plugin through 1.7 does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks...

CVE-2021-24615

CVE-2021-24615 affects the WordPress Wechat Reward plugin (versions 1.7 and earlier). The root cause is lack of sanitisation/escaping of the QR settings and no CSRF protection, enabling a logged-in admin to alter settings and trigger stored XSS on the frontend or settings page. Exploitation detai...

WordPress plugin Wechat Reward 跨站脚本漏洞

WordPress is a set of blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports the hosting of personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress Wechat Reward plugin in versions 1.7 and...

PT-2021-16131 · WordPress · Wechat Reward Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Wechat Reward WordPress plugin versions 1.7 and earlier Description: The issue allows attackers to make a logged-in admin change the settings and perform Cross-Site Scripting attacks due to the lack of sanitization or escaping of its QR...

Wechat Reward <= 1.7 - CSRF to Stored Cross-Site Scripting

The plugin does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks. Put the following payload in the QR setting: "alert/XSS/ The XSS will be triggered in the plugin's...

Wechat Reward <= 1.7 - CSRF to Stored Cross-Site Scripting

The plugin does not sanitise or escape its QR settings, nor has any CSRF check in place, allowing attackers to make a logged in admin change the settings and perform Cross-Site Scripting attacks. PoC Put the following payload in the QR setting: " The XSS will be triggered in the plugin's setting...

WordPress Wechat Reward plugin <= 1.7 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS discovered by 听雨眠 in WordPress Wechat Reward plugin versions = 1.7. Solution Deactivate and delete. This plugin has been closed as of August 10, 2021 and is not available for download. Reason: Security Issue...

Cross-site Scripting (XSS) - Stored in zoujingli/thinkadmin

Description Stored XSS Content allows for the arbitrary execution of JavaScript Proof of Concept In Wechat management at feature - Reply rule management - Follow reply configuration - Default reply configuration - Follow automatic replies Save Reply text with payload : \x3csVg/\x3e XSS will trigg...

Guangdong Agricultural Credit WeChat public number has a logic flaw vulnerability

Guangdong Agricultural Credit WeChat Public Number is the official WeChat public number of Guangdong Rural Credit Union Federation, which mainly publicizes the financial services and reform and development achievements of the provincial federation and the province's agricultural commercial banks...

XSS Vulnerability in WeChat Public Number Backend System

WeChat public number belongs to Tencent, is the developer or business in the WeChat public platform application account, the account and QQ account interoperability, the platform to achieve and specific groups of text, pictures, voice, video, a full range of communication, interaction , the...

Jeecms background exists arbitrary file download vulnerability

jeecms is a content management system developed by Jiangxi Jinlei Technology Development Co., Ltd. that supports WeChat applets, WeChat public/service numbers, column models, content model cross-customization, and content e-commerce with payment and financial settlement. jeecms background exists...

SQL Injection Vulnerability in Wechat Ordering System of Huitong Network

Shenzhen Huitong Network is a solution provider. Huitong Network WeChat Ordering System has a SQL injection vulnerability, which can be exploited by attackers to obtain sensitive information from the database...

Command execution vulnerability in WeChat for Windows (CNVD-2021-55353)

WeChat for windows is a cross-platform communication tool. A command execution vulnerability exists in WeChat for Windows, which can be exploited by an attacker to gain control of the server...

File Upload Vulnerability in Collaborative Office Platform of Microsoft Technology (Hangzhou) Co.

Microsoft Technology Hangzhou Co., Ltd. is a professional ECM Collaboration Management Software and BPM Business Process Management Software R & D and solution provider. A file upload vulnerability exists in the Collaboration Office platform of Microhome Software Technology Hangzhou Co., Ltd, whi...

Logic Flaw Vulnerability in WeChat webaudio Component

WeChat a cross-platform communication tool. A logic flaw vulnerability exists in the WeChat webaudio component that can be exploited by an attacker to cause a denial of service...

Hebei OuRun TianTeng YunMengBar Network Studio YMBCMS Command Execution Vulnerability

YMBCMS is one of the self-developed products under Hebei OuRun TianTeng YunMengBar Network Studio.YMBCMS integrates computer station, cell phone station, WeChat public platform, small program, APP in one, sharing space, data synchronization and so on. Hebei OuRunTianTeng YunMengBar Network Studio...