586 matches found
Wordpress Plugin Activity Log 2.4.0 - Stored Cross-Site Scripting
Wordpress Plugin Activity Log 2.4.0 - Stored Cross-Site Scripting Exploit Title : Activity Log Wordpress Plugin Stored Cross Site Scripting XSS Date: 25-02-2018 Exploit Author : Stefan Broeder Vendor Homepage: https://pojo.me Software Link: https://wordpress.org/plugins/aryo-activity-log/ Version...
WordPress Plugin Activity Log 2.4.0 - Stored Cross-Site Scripting
Exploit Title : Activity Log Wordpress Plugin Stored Cross Site Scripting XSS Date: 25-02-2018 Exploit Author : Stefan Broeder Vendor Homepage: https://pojo.me Software Link: https://wordpress.org/plugins/aryo-activity-log/ Version: 2.4.0 CVE : CVE-2018-8729 Category : webapps Description...
WordPress Plugin Activity Log 2.4.0 - Cross-Site Scripting
WordPress Plugin Activity Log 2.4.0 - Cross-Site Scripting Exploit Title : Activity Log Wordpress Plugin Stored Cross Site Scripting XSS Date: 25-02-2018 Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://pojo.me Software Link:...
WordPress Plugin Activity Log 2.4.0 - Cross-Site Scripting
Exploit Title : Activity Log Wordpress Plugin Stored Cross Site Scripting XSS Date: 25-02-2018 Exploit Author : Stefan Broeder Contact : https://twitter.com/stefanbroeder Vendor Homepage: https://pojo.me Software Link: https://wordpress.org/plugins/aryo-activity-log/ Version: 2.4.0 CVE :...
WordPress Activity Log plugin <=2.4.0 - Multiple Cross-Site Scripting (XSS) vulnerabilities
Multiple Cross-Site Scripting XSS vulnerabilities found in WordPress Activity Log plugin versions =2.4.0 Solution Update the WordPress Activity Log plugin to the latest available version at least 2.4.1...
WordPress Activity Log Plugin Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers set up a personal blog site. activity Log plugin is used in one of the log plugin. A cross-site scripting vulnerability exists in WordPress...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
CVE-2018-8729
CVE-2018-8729 describes multiple Stored XSS flaws in the WordPress Activity Log plugin (aryo-activity-log) prior to 2.4.1. The vulnerability stems from unescaped post/title data stored in logs (e.g., get_the_title calls), allowing remote attackers to inject JavaScript/HTML. Public exploit routes ...
CVE-2018-8729: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the Activity Log plugin before 2.4.1 for WordPress allow remote attackers to inject arbitrary JavaScript or HTML via a title that is not escaped...
PT-2018-18603 · WordPress · Wp Activity Log
Name of the Vulnerable Software and Affected Versions: Activity Log plugin versions prior to 2.4.1 for WordPress Description: The issue allows remote attackers to inject arbitrary JavaScript or HTML via a title that is not properly escaped, potentially leading to cross-site scripting XSS attacks...
Activity Log <= 2.4.0 - Multiple Cross-Site Scripting (XSS)
The Activity Log WordPress plugin was affected by a Multiple Cross-Site Scripting XSS security vulnerability...
WordPress User Activity Log Plugin <= 1.2.3 - Cross-Site Request Forgery (CSRF) and Cross-Site Scripting (XSS) Vulnerabilities
There's no escaping done for $fromemail and $toemail variables. Also, there's missing a nonce check. Solution Update the plugin...
WordPress Activity Log Plugin <= 2.2.12 - Authenticated Information Disclosure Vulnerability
WordPress Activity Log Plugin Authenticated Information Disclosure Vulnerability is due to the AJAX accessible function ajaxaalgetproperties, in the file /classes/class-aal-settings.php, not having a check to make sure that the request is coming from a user and he should be able to access to it...
Weblate: Information Disclosure on demo.weblate.org
Description The demo instance, located on https://demo.weblate.org is leaking user's IP-adresses in the Activity log. F185728 Impact The authenticated user can disclose valid IP adresses of other users through Activity log. The feature works as it should so no changes should be made on the GitHub...