5818 matches found
CVE-2023-4460 Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG
The Uploading SVG, WEBP and ICO files WordPress plugin through 1.2.1 does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads...
PT-2023-32310 · WordPress · Filr
Name of the Vulnerable Software and Affected Versions: Filr WordPress plugin version 1.2.3.6 and earlier Description: The issue allows for Remote Code Execution RCE, enabling the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges...
WordPress Guest Author Plugin <= 2.3 is vulnerable to Cross Site Scripting (XSS)
Software Guest Author Type Plugin Vulnerable versions = 2.3 Fixed in 2.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-49747 Patch priority Medium CVSS severity Medium 5.9 Developer WebFactory Ltd. PSID ddb592007f62 Credits emad Required privilege Author Publishe...
WordPress plugin Filr security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...
WordPress plugin Uploading SVG, WEBP and ICO files security vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...
October CMS 3.4.0 Author Cross Site Scripting
OctoberCMS v3.4.0 Author Stored Cross-Site Scripting Vulnerability Vendor: October CMS Product web page: https://www.octobercms.com Affected version: 3.4.0 Summary: OctoberCMS is a self-hosted content management system CMS based on the PHP programming language and Laravel web application framewor...
CVE-2023-39921
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Molongui Author Box, Guest Author and Co-Authors for Your Posts – Molongui allows Stored XSS.This issue affects Author Box, Guest Author and Co-Authors for Your Posts – Molongui: from n/a through...
CVE-2023-39921
CVE-2023-39921 describes a Stored XSS in the Molongui Author Box, Guest Author and Co-Authors for Your Posts plugin for WordPress (up to 4.6.19). The issue stems from improper input sanitization during web page generation, enabling injection of scripts by authenticated administrators. Affected co...
PT-2023-32668 · Sourcecodester · Sourcecodester Book Borrower System
Name of the Vulnerable Software and Affected Versions: SourceCodester Book Borrower System version 1.0 Description: A vulnerability was found in the system, classified as problematic, affecting some unknown processing of the file "add-book.php". The manipulation of the argument Book Title or Book...
WordPress Plugin Author Box, Guest Author and Co-Authors for Your Posts Cross-Site Scripting Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting vulnerabilit...
Book Borrower System Cross-Site Scripting Vulnerability
Book Borrower System is a book borrowing system by the individual developer Remy Andrade. A cross-site scripting vulnerability exists in Book Borrower System version 1.0, which stems from an incorrect manipulation of the Book Title/Book Author parameter that can lead to cross-site scripting...
PT-2023-27156 · Molongui · Molongui Author Box
Name of the Vulnerable Software and Affected Versions: Molongui Author Box, Guest Author and Co-Authors for Your Posts – Molongui versions through 4.6.19 Description: The issue is related to improper neutralization of input during web page generation, which allows for stored cross-site scripting...
PopojiCMS 2.0.1 Remote Command Execution
Exploit Title: PopojiCMS Version : 2.0.1 Remote Command Execution Date: 27/11/2023 Exploit Author: tmrswrr Vendor Homepage: https://www.popojicms.org/ Software Link: https://github.com/PopojiCMS/PopojiCMS/archive/refs/tags/v2.0.1.zip Version: Version : 2.0.1 Tested on:...
`hann-rs-service` was removed from crates.io for malicious code
This crate was part of a typosquatting malware cluster published by the user TerryDavisSoldier to run an arbitrary malware payload on Windows hosts. This advisory is to retrospectively document this attempted attack. The version information and download records of the malicious crate are no longe...
Social Feed <= 1.5.4.6 - Author+ Stored XSS
Description The plugin does not validate and escape some of its socialfeed shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the Author role and above to perform Stored Cross-Site Scripting attacks...
WordPress Slider Revolution Plugin <= 6.6.15 is vulnerable to Arbitrary File Upload
Software Slider Revolution Type Plugin Vulnerable versions = 6.6.15 Fixed in 6.6.16 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE CVE-2023-47784 Patch priority Low CVSS severity Low 8.4 Developer ThemePunch PSID 92c233355a76 Credits Rafie Muhammad Patchstack Required privile...
Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG
Description The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. PoC As an author, upload an SVG file with malicious JavaScript: Access the file through its URL to see XSS...
Filr – Secure document library < 1.2.3.6 - Author+ RCE via file upload with phar ext
Description The plugin is vulnerable from an RCE Remote Code Execution vulnerability, which allows the operating system to execute commands and fully compromise the server on behalf of a user with Author-level privileges. PoC 1 Go to main dashboard of plugin...
Uploading SVG, WEBP and ICO files <= 1.2.1 - Author+ Stored XSS via SVG
Description The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. As an author, upload an SVG file with malicious JavaScript: alert"pwned by daniloalbugrque"; Access the file through its URL to see...