CVE-2020-20671: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF in KiteCMS V1.1 allows attackers to arbitrarily add an administrator account...

CVE-2021-24586: Cross-Site Request Forgery (CSRF)

The Per page add to head WordPress plugin before 1.4.4 is lacking any CSRF check when saving its settings, which could allow attackers to make a logged in admin change them. Furthermore, as the plugin allows arbitrary HTML to be inserted in one of the setting feature mentioned by the plugin, this...

CVE-2021-24619: Improper Neutralization of Input During Web Page Generation

The Per page add to head WordPress plugin through 1.4.4 does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfilteredhtml capability is disallowed, which could lead to Cross-Site Scripting issues...

CVE-2021-38340

The Wordpress Simple Shop WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the updaterow parameter found in the /includes/addproduct.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

CVE-2020-19268

A cross-site request forgery CSRF in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add administrator users...

CVE-2020-19268: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF in index.php/Dswjcms/User/tfAdd of Dswjcms 1.6.4 allows authenticated attackers to arbitrarily add administrator users...

CVE-2020-19293: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS vulnerability in the /article/add component of Jeesns 1.4.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payload in a posted article...

Haproxy HAProxy 输入验证错误漏洞

HAProxy is an open source TCP/HTTP load balancing server from the French company HAProxy=. =HAProxy suffers from an input validation error vulnerability, which stems from a lack of header name length checking in the htxaddheader and htxaddtrailer functions in HAProxy, and can be exploited by an...

UBUNTU-CVE-2021-40346

An integer overflow exists in HAProxy 2.0 through 2.5 in htxaddheader that can be exploited to perform an HTTP request smuggling attack, allowing an attacker to bypass all configured http-request HAProxy ACLs and possibly other ACLs...

PT-2021-6480 · Linux +2 · Linux Kernel +2

Name of the Vulnerable Software and Affected Versions: Linux kernel affected versions not specified Description: A use-after-free flaw was found in the add partition function in the Linux kernel, specifically in the block/partitions/core.c file. This issue can be exploited by a local attacker wit...

Cross site request forgery (csrf)

WTCMS 1.0 contains a cross-site request forgery CSRF vulnerability in the index.php?g=admin&m=nav&a=addpost component that allows attackers to arbitrarily add articles in the administrator background...

CVE-2020-20343

WTCMS 1.0 contains a cross-site request forgery CSRF vulnerability in the index.php?g=admin&m=nav&a=addpost component that allows attackers to arbitrarily add articles in the administrator background...

WordPress GetPaid payments plugin 2.4.6 - HTML Injection Vulnerability

Exploit Title: WordPress Plugin Payments Plugin | GetPaid 2.4.6 - HTML Injection Exploit Author: Niraj Mahajan Software Link: https://wordpress.org/plugins/invoicing/ Version: 2.4.6 Tested on Windows Steps to Reproduce: 1. Install Wordpress 5.8 2. Install and Activate "WordPress Payments Plugin |...

CVE-2020-20343: Cross-Site Request Forgery (CSRF)

WTCMS 1.0 contains a cross-site request forgery CSRF vulnerability in the index.php?g=admin&m=nav&a=addpost component that allows attackers to arbitrarily add articles in the administrator background...

CVE-2020-19048

Cross Site Scripting XSS in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'...

CVE-2020-19049

Cross Site Scripting XSS in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'...

CVE-2020-19048

Cross Site Scripting XSS in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Title" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'...

Cross site scripting

Cross Site Scripting XSS in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'...

CVE-2020-19049

Cross Site Scripting XSS in MyBB v1.8.20 allows remote attackers to inject arbitrary web script or HTML via the "Description" field found in the "Add New Forum" page by doing an authenticated POST HTTP request to '/Upload/admin/index.php?module=forum-management&action=add'...

PT-2021-10277 · Mybb · Mybb

Name of the Vulnerable Software and Affected Versions: MyBB version 1.8.20 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the Title field in the Add New Forum page. This can be achieved by doing an authenticated POST HTTP request to...