WordPress Encrypted Contact Form 1.0.4 CSRF / XSS

Title: Cross-site Request Forgery & Cross-site Scripting in Encrypted Contact Form Wordpress Plugin v1.0.4 Submitter: Nitin Venkatesh Product: Encrypted Contact Form Wordpress Plugin Product URL: https://wordpress.org/plugins/encrypted-contact-form/ Vulnerability Type: Cross-site Request Forgery...

WordPress plugin WP Slimstat 'wp-admin/admin.php' cross-site scripting vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their weblogs on servers that support PHP and MySQL databases. A cross-site scripting vulnerability exists in the WordPress plugin WP Slimstat 'wp-admin/admin.php', which can be exploited by an attacker ...

itBit Exchange: Stored xss in bank name withdraw

Open https://beta.itbit.com/accounts 2. Add new Bank Account with payload in name field - Bank of New York'"asdF 3. Save this account and 4. Select it as a target to withdraw As you can see in screenshot at this time there is some problem with javascript code some filtration affected but we...

Mobile Vikings: Stored XSS in Direct debit name

Make new or edit old Direct debit for example https://mobilevikings.be/en/account/easypay/correct-direct-debit-mandate/111366/ 2. Fill owners name with payload asdf'"alertdocument.cookie 3. Save form. We got Stored XSS in pages: https://mobilevikings.be/en/account/easypay/...

CVE-2014-10035

Multiple cross-site scripting XSS vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitrary web script or HTML via the 1 sEcho parameter to commentspaginate.php or 2 storespaginate.php or the 3 affiliateurl, 4 description, 5 domain, 6...

CVE-2014-10034

Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the 1 iDisplayLength or 2 iDisplayStart parameter to a commentspaginate.php or b storespaginate.php in admin/ajax/...

Sql injection

Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the 1 iDisplayLength or 2 iDisplayStart parameter to a commentspaginate.php or b storespaginate.php in admin/ajax/...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitrary web script or HTML via the 1 sEcho parameter to commentspaginate.php or 2 storespaginate.php or the 3 affiliateurl, 4 description, 5 domain, 6...

CVE-2014-10034

Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the 1 iDisplayLength or 2 iDisplayStart parameter to a commentspaginate.php or b storespaginate.php in admin/ajax/...

CVE-2014-10034

CVE-2014-10034 affects couponPHP prior to 1.2.0. The admin area is vulnerable to SQL injection via the iDisplayLength and iDisplayStart parameters in comments_paginate.php and stores_paginate.php under admin/ajax/, enabling remote attackers with valid admin access to manipulate SQL queries. Relat...

CVE-2014-10035

CVE-2014-10035 affects couponPHP before 1.2.0. The admin area is vulnerable to multiple XSS flaws where an attacker can inject arbitrary script/HTML via parameters such as sEcho in comments_paginate.php, stores_paginate.php, and several admin/index.php fields (affiliate_url, description, domain, ...

CVE-2014-10035: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to inject arbitrary web script or HTML via the 1 sEcho parameter to commentspaginate.php or 2 storespaginate.php or the 3 affiliateurl, 4 description, 5 domain, 6...

CVE-2014-10034: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the admin area in couponPHP before 1.2.0 allow remote administrators to execute arbitrary SQL commands via the 1 iDisplayLength or 2 iDisplayStart parameter to a commentspaginate.php or b storespaginate.php in admin/ajax/...

PT-2015-3679

Name of the Vulnerable Software and Affected Versions couponPHP versions prior to 1.2.0 Description The issue concerns multiple cross-site scripting XSS vulnerabilities in the admin area. These vulnerabilities allow remote administrators to inject arbitrary web script or HTML via various...

PT-2015-3678

Name of the Vulnerable Software and Affected Versions couponPHP versions prior to 1.2.0 Description The issue concerns SQL injection vulnerabilities in the admin area. These vulnerabilities allow remote administrators to execute arbitrary SQL commands. The vulnerabilities are specifically related...

CVE-2014-8771

Multiple cross-site request forgery CSRF vulnerabilities in the admin area in X3 CMS 0.5.1 and 0.5.1.1 allow remote attackers to hijack the authentication of administrators via unspecified vectors...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the admin area in X3 CMS 0.5.1 and 0.5.1.1 allow remote attackers to hijack the authentication of administrators via unspecified vectors...

CVE-2014-8771

CVE-2014-8771 affects X3 CMS versions 0.5.1 and 0.5.1.1, with multiple CSRF vulnerabilities in the admin area that allow remote attackers to hijack administrator authentication via unspecified vectors. Exploitation details are not provided in the available documents. The entry’s CVSS assessment i...

PT-2014-8726

Name of the Vulnerable Software and Affected Versions X3 CMS versions 0.5.1 through 0.5.1.1 Description The issue concerns multiple cross-site request forgery CSRF vulnerabilities in the admin area. These vulnerabilities allow remote attackers to hijack the authentication of administrators via...

CVE-2014-8771: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the admin area in X3 CMS 0.5.1 and 0.5.1.1 allow remote attackers to hijack the authentication of administrators via unspecified vectors...