CVE-2022-23330

A remote code execution RCE vulnerability in HelloWorldAddonController.java of jpress v4.2.0 allows attackers to execute arbitrary code via a crafted JAR package...

jpress 安全漏洞

Jpress is a blogging platform developed by the Jpress team using the Java language. A security vulnerability exists in jpress, which stems from a Remote Code Execution RCE vulnerability in HelloWorldAddonController.java in jpress v4.2.0 that allows an attacker to execute arbitrary code via a...

WordPress Classic Editor Addon plugin <= 2.6.3 - Arbitrary Plugin Activation vulnerability

Arbitrary Plugin Activation vulnerability discovered by Jan w Oleju in WordPress Classic Editor Addon plugin versions = 2.6.3. Solution Update the WordPress Classic Editor Addon plugin to the latest available version at least 2.6.4...

Jpress 命令注入漏洞

Jpress is a set of blogging platforms developed by the Jpress team using the Java language. an access control error vulnerability exists in Jpress, which stems from the product allowing the io.jpress.web.admin.AddonController::doUploadAndInstall function to execute commands. No detailed...

PT-2021-16394 · WordPress · Wp Rss Aggregator

Name of the Vulnerable Software and Affected Versions: WP RSS Aggregator versions prior to 4.19.3 Description: The issue is related to a Stored XSS problem. It occurs because data is not properly sanitised and escaped before being output in the System Info admin dashboard. This is due to the wprs...

WordPress Cross-Site Scripting Vulnerability (CNVD-2021-102388)

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Contact Form 7 Database Addon CFDB7...

CVE-2021-36885

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.6.1...

CVE-2021-36886

Cross-Site Request Forgery CSRF vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9...

CVE-2021-36886

Cross-Site Request Forgery CSRF vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9...

Cross site scripting

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.6.1...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability discovered in Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9...

CVE-2021-36886

CVE-2021-36886 affects the WordPress plugin Contact Form 7 Database Addon (CFDB7) versions up to 1.2.5.9. Root cause is CSRF due to lack of token validation, enabling unauthorized actions when a logged-in user visits a malicious page. Impact is CSRF risk on sites using CFDB7

CVE-2021-36885

CFDB7 (Contact Form 7 Database Addon) WordPress plugin versions

PT-2021-21395 · WordPress · Contact Form 7 Database Addon

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.6.1 Description: The issue is related to an Unauthenticated Stored Cross-Site Scripting XSS vulnerability. Recommendations: For versions = 1.2.6.1, update to a version high...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress plugin Contact Form 7 Database Addon CFDB7...

PT-2021-21396 · WordPress · Contact Form 7 Database Addon – Cfdb7

Name of the Vulnerable Software and Affected Versions: Contact Form 7 Database Addon – CFDB7 WordPress plugin versions = 1.2.5.9 Description: A Cross-Site Request Forgery CSRF issue was found in the Contact Form 7 Database Addon – CFDB7 WordPress plugin. This type of issue allows an attacker to...

WordPress 插件跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin Contact Form 7 Database...

CVE-2021-45099

The addon.stdin service in addon-ssh aka Home Assistant Community Add-on: SSH & Web Terminal before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against...

CVE-2021-45099

The addon.stdin service in addon-ssh aka Home Assistant Community Add-on: SSH & Web Terminal before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against...

CVE-2021-45099

The addon.stdin service in addon-ssh aka Home Assistant Community Add-on: SSH & Web Terminal before 10.0.0 has an attack surface that requires social engineering. NOTE: the vendor does not agree that this is a vulnerability; however, addon.stdin was removed as a defense-in-depth measure against...