2037 matches found
CVE-2018-7274
Yab Quarx through 2.4.3 is prone to multiple persistent cross-site scripting vulnerabilities: Blog Title, FAQ Question, Pages Title, Widgets Name, and Menus Name...
CVE-2018-7274
CVE-2018-7274 affects Yab Quarx CMS (through 2.4.3). It is a persistent Cross-Site Scripting vulnerability affecting multiple fields: Blog (Title), FAQ (Question), Pages (Title), Widgets (Name), and Menus (Name). Root cause: insufficient sanitization of user-supplied input. Impact: remote-exploit...
Valve: Xss was found by exploiting the URL markdown on http://store.steampowered.com
Hello guys I found an xss vulnerability on store.steampowered.com markdown POC http://store.steampowered.com/widget/386360/?t=url=google.com:/onclick=%27alertdocument.domain%27url=xss/url Here is my exploit url=google.com:/onclick='alertdocument.domain'url=xss/url Steps 1 - go to any product 2 -...
DRUPAL-CONTRIB-2018-001
This module enables content editors to create complex pages and layouts on the fly without the help from a developer, using reusable widgets. The module does not sufficiently filter values posted to its AJAX endpoint, which leads to the instantiation of an arbitrary PHP class. This vulnerability ...
Stacks - Critical - Arbitrary PHP code execution - SA-CONTRIB-2018-001
This module enables content editors to create complex pages and layouts on the fly without the help from a developer, using reusable widgets. The module does not sufficiently filter values posted to its AJAX endpoint, which leads to the instantiation of an arbitrary PHP class. This vulnerability ...
WordPress WP-Contact-Widgets 1.4.1 Cross Site Scripting Vulnerability
WordPress WP-Contact-Widgets plugin version 1.4.1 suffers from a stored cross site scripting vulnerability. Exploit Title: Stored XSS on wp-contact-widgets 1.4.1 wordpress plugin Exploit Author: Boumediene KADDOUR Publisher: R&D Unit Algerie Telecom Version: 1.4.1 Application website:...
WordPress Display Widgets Plugin Spammers Backdoor
A backdoor vulnerability exists in WordPress Display Widgets Plugin. Successful exploitation of this vulnerability allows remote attackers to change the effected site's content...
Rogue Wordpress Plugin Allowed Spam Injection
A popular WordPress plugin called Display Widgets running on 200,000 sites was removed from the official WordPress.org plugin repository after researchers discovered the plugin had a backdoor that was injecting spam ads into victims’ sites. According to researchers at Wordfence who publicly...
WordPress Display Widgets plugin has a backdoor
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Display Widgets is a WordPress display plugin. WordPress Display Widgets plugin has a backdoor, attackers can use...
Display Widgets 2.6.0-2.6.3.1 - Backdoored
The display-widgets WordPress plugin was affected by a Backdoored security vulnerability...
WordPress Display Widgets plugin 2.6.0-2.6.3.1 - Backdoored (includes hacking tool)
The possible backdoor hacking tool found in WordPress Display Widgets plugin versions 2.6.0-2.6.3.1 by SEO Dave. Solution Deactivate and remove the WordPress Display Widgets plugin. For now, this plugin removed from WordPress plugin repository...
Gratipay: Show hide privacy giving receiving on my website
Hi team .. I found show hide privacy settings on website ... nobody can see on my profile but i put code on my website anybode can see my total giving .. Step reprodence .. 1- go to https://gratipay.com/demo/settings/ click turn on hide total to giving other and hide my self from search result th...
CVE-2017-5492
Cross-site request forgery CSRF vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php...
DEBIAN-CVE-2017-5492
Cross-site request forgery CSRF vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php...
CVE-2017-5492
Cross-site request forgery CSRF vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php...
Pornhub: Stored XSS on the http://ht.pornhub.com/widgets/
The researcher found a stored XSS in the HubTraffic widgets section. I found Stored XSS in the Hubtraffic widgets section. The team was very responsible and fixed the issue fast. Many thanks to the PornHub security team for the bounty and swag i received it already, very cool!...
Wordpress plugin content-glass-button has multiple cross-site scripting vulnerabilities
Content Glass is a social tool that allows website users to share widgets with peers-groups with page address fields or TLDs. The Wordpress plugin content-glass-button is vulnerable to an xss vulnerability due to improper filtering of user input, which allows attackers to frame malicious web page...
