1596 matches found
CVE-2022-24594
In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...
CVE-2022-24594
In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...
CVE-2022-24594
In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...
CVE-2022-24594
CVE-2022-24594 affects waline 1.6.1. An attacker can submit messages with a forged IP address by manipulating the X-Forwarded-For header, enabling IP spoofing. Multiple connected sources (Red Hat advisory, Veracode note) indicate this can bypass IP-related checks such as IP frequency limits, affe...
CVE-2022-24594: Missing Authorization
In waline 1.6.1, an attacker can submit messages using X-Forwarded-For to forge any IP address...
PT-2022-16744
Name of the Vulnerable Software and Affected Versions waline version 1.6.1 Description The issue allows an attacker to submit messages using the X-Forwarded-For header to forge any IP address. Recommendations For waline version 1.6.1, consider restricting the use of the X-Forwarded-For header unt...
WordPress Perfect Survey plugin cross-site scripting vulnerability
WordPress is the WordPress Foundation's suite of blogging platforms developed using the PHP language. WordPress Perfect Survey plugin in version 1.5.2 and prior versions suffers from a cross-site scripting vulnerability that stems from not validating and escaping the X-Forwarded-For header value,...
CVE-2021-24765
The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...
Cross site scripting
The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...
CVE-2021-24765
The CVE-2021-24765 issue affects the WordPress Perfect Survey plugin up to version 1.5.2. The root cause is failure to validate/escape the X-Forwarded-For header when Anonymize IP is off, allowing Stored Cross-Site Scripting on the statistic page. Affected component: the plugin’s statistic page r...
PT-2022-9461
Name of the Vulnerable Software and Affected Versions The Perfect Survey WordPress plugin versions 1.5.2 and earlier Description The issue arises from the lack of validation and escaping of the X-Forwarded-For header value before it is outputted in the statistic page. This occurs when the Anonymi...
CVE-2021-24765: Improper Neutralization of Input During Web Page Generation
The Perfect Survey WordPress plugin through 1.5.2 does not validate and escape the X-Forwarded-For header value before outputting it in the statistic page when the Anonymize IP setting of a survey is turned off, leading to a Stored Cross-Site Scripting issue...
Cross site scripting
The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry...
CVE-2021-25080: Improper Neutralization of Input During Web Page Generation
The Contact Form Entries WordPress plugin before 1.1.7 does not validate, sanitise and escape the IP address retrieved via headers such as CLIENT-IP and X-FORWARDED-FOR, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against logged in admins viewing the created entry...
PT-2022-9636
Name of the Vulnerable Software and Affected Versions Contact Form Entries WordPress plugin versions prior to 1.1.7 Description The issue allows unauthenticated attackers to perform Cross-Site Scripting attacks against logged-in admins viewing the created entry. This is due to the plugin not...
PT-2022-9534
Name of the Vulnerable Software and Affected Versions LiteSpeed Cache WordPress plugin versions prior to 4.4.4 Description The issue arises from the plugin not properly verifying requests from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific...
CVE-2021-24964: Improper Neutralization of Input During Web Page Generation
The LiteSpeed Cache WordPress plugin before 4.4.4 does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if...
PT-2021-21404
Name of the Vulnerable Software and Affected Versions Hide My WP WordPress plugin versions = 6.2.3 Description The issue arises from how the IP address is retrieved and used in a SQL query. The hmwp get user ip function attempts to retrieve the IP address from multiple headers, including IP addre...
CVE-2021-36916: Improper Neutralization of Special Elements used in an SQL Command
The SQL injection vulnerability in the Hide My WP WordPress plugin versions = 6.2.3 is possible because of how the IP address is retrieved and used inside a SQL query. The function "hmwpgetuserip" tries to retrieve the IP address from multiple headers, including IP address headers that the user c...
