Web Security Expands into Secure Service Edge (SSE)

Trend has been securing web access for over a decade with forward-looking innovation and a global footprint to support our customer’s security strategy. We are committed to our customers’ journey of transforming their current security posture, aligning with Zero Trust principles, and embracing a...

Vulnerability Researchers: Check out The Critical Thinking Podcast

Today, The Wordfence Bug Bounty Program was featured on an episode of the Critical Thinking Podcast, a top resource and community for bug bounty researchers. Critical Thinking is a podcast focused on ethical hacking and security analysis and is described as a “by Hackers for Hackers podcast focus...

michelbulteau.com Improper Access Control vulnerability OBB-3805540

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cross site scripting

An XSS issue was discovered in a web endpoint in Zimbra Collaboration ZCS before 10.0.4 via an unsanitized parameter. This is also fixed in 8.8.15 Patch 43 and 9.0.0 Patch 36...

CVE-2023-48940

DaiCuo v2.5.15 contains a stored XSS in /admin.php. The vulnerability allows an attacker to execute arbitrary web scripts or HTML via a crafted payload. CVSS~3.1 base score 5.4 (NETWORK, LOW attack complexity, user interaction required). Evidence is limited to the CVE description and associated r...

lopezfernandezabogados.com Improper Access Control vulnerability OBB-3804007

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

bikuri.net Cross Site Scripting vulnerability OBB-3803493

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

quarkus: HTTP security policy bypass

A flaw was found in Quarkus where HTTP security policies are not sanitizing certain character permutations correctly when accepting requests, resulting in incorrect evaluation of permissions. This issue could allow an attacker to bypass the security policy altogether, resulting in unauthorized...

PHPJabbers Availability Booking Calendar 5.0 HTML Injection

Exploit Title: PHPJabbers Availability Booking Calendar v5.0 - HTML Injection Date: 13/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/availability-booking-calendar/sectionDemo Version: v5.0...

PHPJabbers Appointment Scheduler 3.0 HTML Injection

Exploit Title: PHPJabbers Appointment Scheduler v3.0 - Multiple HTML Injection Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/appointment-scheduler/ Version: v3.0 Tested on: Window...

PHPJabbers Time Slots Booking Calendar 4.0 HTML Injection

Exploit Title: PHPJabbers Time Slots Booking Calendar v4.0 - HTML Injection Date: 13/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/time-slots-booking-calendar/ Version: v4.0 Tested on:...

PHPJabbers Car Rental 3.0 HTML Injection

Exploit Title: PHPJabbers Car Rental v3.0 - HTML Injection Date: 19/11/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/car-rental-script/ Version: v3.0 Tested on: Windows 10, Windows 11, Linux...

e-ter.com Improper Access Control vulnerability OBB-3799037

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-48746

CVE-2023-48746 affects the WordPress plugin Community by PeepSo (PeepSo Core) up to version 6.2.6.0, with a Reflected Cross-Site Scripting (XSS) vulnerability in Web Page Generation input handling. The root cause is improper input neutralization during page generation, enabling unauthenticated at...

CVE-2023-48749

CVE-2023-48749: Salient Core for WordPress is affected by an Stored XSS due to improper input neutralization in web page generation. The vulnerability applies to Salient Core versions

CVE-2023-39921

CVE-2023-39921 describes a Stored XSS in the Molongui Author Box, Guest Author and Co-Authors for Your Posts plugin for WordPress (up to 4.6.19). The issue stems from improper input sanitization during web page generation, enabling injection of scripts by authenticated administrators. Affected co...

auteursdumaine.net Cross Site Scripting vulnerability OBB-3798725

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

CVE-2023-47850

CVE-2023-47850 affects the WordPress plugin Community by PeepSo – PeepSo Core up to version 6.2.2.0, with stored stored Cross-Site Scripting (XSS) arising from improper input neutralization during web page generation. Public details confirm the vulnerability and affected versions; PatchStack note...

CVE-2023-48329

CVE-2023-48329 affects the WordPress plugin Fast Custom Social Share by CodeBard (versions ≤ 1.1.1). The issue is a Cross-Site Scripting (Stored XSS) caused by improper neutralization during web page generation. Exploitation requires administrator privileges, and the vulnerability status is curre...

fokus-leben.de Cross Site Scripting vulnerability OBB-3798690

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...