Firmware Analysis and Comparison Tool 跨站请求伪造漏洞

Firmware Analysis and Comparison Tool FACT is a firmware analysis and comparison tool. firmware Analysis and Comparison Tool version v3.2 contains a cross-site request forgery vulnerability that stems from a WEB application that does not adequately validate that the request is from a trusted user...

WordPress plugin Maps 跨站请求伪造漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. A cross-site request forgery vulnerability exists in versions of the WordPress Google Maps plugin prior to 1.8.4. The vulnerability stems from the plugin's failure to perform CSRF checks in most ...

CVE-2022-0020

A stored cross-site scripting XSS vulnerability in Palo Alto Network Cortex XSOAR web interface enables an authenticated network-based attacker to store a persistent javascript payload that will perform arbitrary actions in the Cortex XSOAR web interface on behalf of authenticated administrators...

OpenBMCS 2.4 - Cross Site Request Forgery (CSRF)

Exploit Title: OpenBMCS 2.4 - Cross Site Request Forgery CSRF Exploit Author: LiquidWorm Date: 26/10/2021 OpenBMCS 2.4 CSRF Send E-mail Vendor: OPEN BMCS Product web page: https://www.openbmcs.com Affected version: 2.4 Summary: Building Management & Controls System BMCS. No matter what the size o...

WordPress Plugin "Browser and Operating System Finder" vulnerable to cross-site request forgery

Overview WordPress Plugin "Browser and Operating System Finder" provided by Aftab Muni contains a cross-site request forgery vulnerability CWE-352. imai shinpei of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University reported and coordinated with...

CVE-2021-24641

The Images to WebP WordPress plugin before 1.9 does not have CSRF checks in place when performing some administrative actions, which could result in modification of plugin settings, Denial-of-Service, as well as arbitrary image conversion...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin that stems from The Images to WebP...

WordPress Plugin "Push Notifications for WordPress (Lite)" vulnerable to cross-site request forgery

Overview WordPress Plugin "Push Notifications for WordPress Lite" provided by Delite Studio contains a cross-site request forgery vulnerability CWE-352. Ten Katouno of Cryptography Laboratory,Department of Information and Communication Engineering,Tokyo Denki University reported and coordinated...

Cross site scripting

AVideo/YouPHPTube 10.0 and prior has multiple reflected Cross Script Scripting vulnerabilities via the u parameter which allows a remote attacker to steal administrators' session cookies or perform actions as an administrator...

CVE-2021-25875

The CVE affects AVideo/YouPHPTube versions 10.0 and prior, where multiple reflected cross-site scripting (XSS) vulnerabilities exist in the searchPhrase parameter. The underlying issue enables a remote attacker to steal an administrator’s session cookies or perform actions as an administrator. Th...

AVideo 和 YouPHPTube 跨站脚本漏洞

YouPHPTube is a PHP-based video website system. wwbn Avideo is a video platform builder written in PHP by the team at wwbn WWBN. AVideo and YouPHPTube suffer from a cross-site scripting vulnerability that could be exploited by a remote attacker to steal an administrator's session cookie or perfor...

Two Way Chat < 3.1.5 - Multiple CSRF

The plugin does not have CSRF checks in place in some of its functions, allowing attacker to make logged in admin perform unwanted actions, such as update the plugin's settings. PoC...

CVE-2021-3052

A reflected cross-site scripting XSS vulnerability in the Palo Alto Network PAN-OS web interface enables an authenticated network-based attacker to mislead another authenticated PAN-OS administrator to click on a specially crafted link that performs arbitrary actions in the PAN-OS web interface a...

PT-2021-22062 · WordPress · Nested Pages

Name of the Vulnerable Software and Affected Versions: Nested Pages WordPress plugin versions = 3.1.15 Description: The issue allows attackers to perform Cross-Site Request Forgery attacks via the npBulkAction and npBulkEdit actions, enabling them to modify posts, including trashing or purging...

CVE-2021-39250

Invision Community aka IPS Community Suite or IP-Board before 4.6.5.1 allows stored XSS, with resultant code execution, because an uploaded file can be placed in an IFRAME element within user-generated content. For code execution, the attacker can rely on the ability of an admin to install widget...

PYSEC-2021-143

Cross Site Scripting XSS in Quokka v0.4.0 allows remote attackers to execute arbitrary code via the 'Username' parameter in the component 'quokka/admin/actions.py'...

CVE-2021-24466

The Verse-O-Matic WordPress plugin through 4.1.1 does not have any CSRF checks in place, allowing attackers to make logged in administrators do unwanted actions, such as add/edit/delete arbitrary verses and change the settings. Due to the lack of sanitisation in the settings and verses, this coul...

Quokka跨站脚本漏洞

Quokka is a content management framework written in Python. version 0.4.0 of Quokka is vulnerable to a cross-site scripting vulnerability. An attacker can exploit the vulnerability to execute arbitrary code via the Username parameter in the quokka/admin/actions.py component...

OpenIAM 安全漏洞

OpenIAM is a fully integrated identity and access management platform. A privilege control impropriety vulnerability exists in OpenIAM versions prior to 4.2.0.3. The vulnerability stems from OpenIAM not verifying that a user has permission to perform /webconsole/rest/api/ administrative operation...

Kagemai vulnerable to cross-site request forgery

Overview Kagemai provided by daifukuya.com is a bug tracking system to share bug information of the software being developed among its development team. Kagemai contains a cross-site request forgery vulnerability CWE-352 which allows unintended operations if a user with an administrative privileg...