CVE-2021-34631

The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handlesavestyle function found in the /news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18...

Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability (CNVD-2021-62976)

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

CVE-2021-34633: Cross-Site Request Forgery (CSRF)

The Youtube Feeder WordPress plugin is vulnerable to Cross-Site Request Forgery via the printAdminPage function found in the /youtube-feeder.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 2.0.1...

Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability (CNVD-2021-62969)

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

PT-2021-20601

Name of the Vulnerable Software and Affected Versions: Youtube Feeder WordPress plugin versions up to and including 2.0.1 Description: The issue concerns Cross-Site Request Forgery, allowing attackers to inject arbitrary web scripts via the printAdminPage function found in the /youtube-feeder.php...

CVE-2021-34631: Cross-Site Request Forgery (CSRF)

The NewsPlugin WordPress plugin is vulnerable to Cross-Site Request Forgery via the handlesavestyle function found in the /news-plugin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0.18...

Liferay Portal and Liferay DXP Cross-Site Scripting Vulnerability (CNVD-2021-62970)

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

PT-2021-20599

Name of the Vulnerable Software and Affected Versions: NewsPlugin WordPress plugin versions up to and including 1.0.18 Description: The issue allows attackers to inject arbitrary web scripts via Cross-Site Request Forgery, leveraging the handle save style function found in the /news-plugin.php...

PT-2021-20602

Name of the Vulnerable Software and Affected Versions: Nifty Newsletters WordPress plugin versions prior to 4.0.24 Description: The issue allows attackers to inject arbitrary web scripts via Cross-Site Request Forgery, utilizing the sola nl wp head function found in the /sola-newsletters.php file...

Liferay Portal和Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

CVE-2021-36702

The "content" field in the "regular post" page of the "add content" menu under "dashboard" in htmly 2.8.1 has a storage cross site scripting XSS vulnerability. It allows remote attackers to send authenticated post-http requests to add / content and inject arbitrary web scripts or HTML through...

Liferay Portal 和 Liferay DXP 跨站脚本漏洞

Liferay Portal and Liferay DXP are both products of Liferay, a J2EE-based portal solution that uses EJB and JMS technologies and serves as a web publishing and shared workspace, enterprise collaboration platform, social network, etc. Liferay DXP is a digital experience collaboration platform...

MaxSite CMS 跨站脚本漏洞

MaxSite CMS is a web content management system from the Russian MaxSite CMS open source project. MaxSite CMS has a security vulnerability that allows remote attackers to inject arbitrary web scripts into the page using the vulnerability...

CVE-2021-34632

The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the locconfig function found in the /seo-backlinks.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.1...

Cross site request forgery (csrf)

The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the /includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7...

CVE-2021-34632 SEO Backlinks <= 4.0.1 - Cross-Site Request Forgery to Stored Cross-Site Scripting

The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the locconfig function found in the /seo-backlinks.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.1...

CVE-2021-34632: Cross-Site Request Forgery (CSRF)

The SEO Backlinks WordPress plugin is vulnerable to Cross-Site Request Forgery via the locconfig function found in the /seo-backlinks.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.0.1...

CVE-2021-34637: Cross-Site Request Forgery (CSRF)

The Post Index WordPress plugin is vulnerable to Cross-Site Request Forgery via the OptionsPage function found in the /php/settings.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 0.7.5...

CVE-2021-34628: Cross-Site Request Forgery (CSRF)

The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the /includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7...