CVE-2021-24133

Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account...

Cross site request forgery (csrf)

Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account...

CVE-2021-24133

The CVE-2021-24133 entry concerns the WordPress ActiveCampaign plugin prior to version 8.0.2, where a lack of CSRF checks on the Settings form could allow a logged-in administrator to change API credentials to the attacker’s account. Affected component: ActiveCampaign WordPress plugin (settings h...

CVE-2021-24133 ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings

Lack of CSRF checks in the ActiveCampaign WordPress plugin, versions before 8.0.2, on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account...

Wordpress ActiveCampaign 跨站请求伪造漏洞

Wordpress ActiveCampaign is Wordpress open source an application plugin . The WordPress ActiveCampaign plugin, versions before 8.0.2 suffers from a cross-site request forgery vulnerability that stems from a lack of CSRF checks, which can be exploited by an attacker to exploit an account's API...

Finding Results at the Intersection of Security and Engineering

As vice president and head of global security at ActiveCampaign, I’m fortunate to be able to draw on a multitude of experiences and successes in my career. I started in general network security, where I was involved in pen testing and security research. I worked at several multibillion-dollar Saa...

WordPress ActiveCampaign plugin <= 8.0.1 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Nguyen Anh Tien SunCSR in WordPress ActiveCampaign plugin versions = 8.0.1. Solution Update the WordPress ActiveCampaign plugin to the latest available version at least 8.0.2...

ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings

The ActiveCampaign 8.0.1 plugin is lacking CSRF check on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account. PoC When a logged-in administrator accesses an HTML page embedded below content, the plugin's setting will be...

ActiveCampaign < 8.0.2 - Cross-Site Request Forgery in Settings

The ActiveCampaign 8.0.1 plugin is lacking CSRF check on its Settings form, which could allow attacker to make a logged-in administrator change API Credentials to attacker's account. When a logged-in administrator accesses an HTML page embedded below content, the plugin's setting will be changed...

Stripo Inc: SSRF via Export Service in ActiveCampaign

SSRF with ActiveCampaign...

Takeover v0.2 - Sub-Domain TakeOver Vulnerability Scanner

Sub-domain takeover vulnerability occur when a sub-domain subdomain.example.com is pointing to a service e.g: GitHub , AWS/S3 ,.. that has been removed or deleted. This allows an attacker to set up a page on the service that was being used and point their page to that sub-domain. For example, if...

Stripo Inc: SSRF in Export template to ActiveCampaign

Summary: I found a SSRF vulneranility in export template to email marketing platform ActiveCampaign. Steps To Reproduce: add details for how we can reproduce the issue 1. Login to your account in 1. Go to https://my.stripo.email/cabinet//templates/ 1. Click on Create your first mail & select one...

at.activecampaign.com XSS vulnerability

Open Bug Bounty ID: OBB-630584 Description| Value ---|--- Affected Website:| at.activecampaign.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

activecampaign.com XSS vulnerability

Open Bug Bounty ID: OBB-574388 Description| Value ---|--- Affected Website:| activecampaign.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

activecampaign.com XSS vulnerability

Open Bug Bounty ID: OBB-554251 Description| Value ---|--- Affected Website:| activecampaign.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

activecampaign.com XSS vulnerability

Vulnerable URL: https://www.activecampaign.com/marketplace/index.php?s=random=8123220442=1=" Details: Description| Value ---|--- Patched:| Yes, at 19.07.2017 Latest check for patch:| 19.07.2017 15:04 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| 23600 VIP...

activecampaign.com XSS vulnerability

Vulnerable URL: https://www.activecampaign.com/login/?section=feedas%22%3E%3Cimg%20src=x%20onerror=prompt%28%27XSSPOSED%27%29%3E Details: Description| Value ---|--- Patched:| Yes, at 04.04.2016 Latest check for patch:| 04.04.2016 01:35 GMT Vulnerability type:| XSS Vulnerability status:| Publicly...

ActiveCampaign SupportTrio 2.50.2 - Multiple Cross-Site Scripting Vulnerabilities

No description provided by source. ActiveCampaign SupportTrio is prone to multiple cross-site scripting vulnerabilities. These issues are due to a failure in the application to properly sanitize user-supplied input. An attacker may leverage these issues to have arbitrary script code executed in t...

ActiveCampaign KnowledgeBuilder 2.2 - Remote File Include Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/20020/info ActiveCampaign KnowledgeBuilder is prone to a remote file-include vulnerability because it fails to sufficiently sanitize user-supplied data. This may allow an attacker to compromise the application and the...

ActiveCampaign 1-2-All Broadcast Email 4.0 Admin Control Panel Username SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15400/info ActiveCampaign 1-2-All Broadcast Email is prone to an SQL-injection vulnerability. This is an input-validation issue related to data that will be used in SQL queries, allowing a remote user to influence the...