CVE-2023-4643 Enable Media Replace < 4.1.3 - Author+ PHP Object Injection

The Enable Media Replace WordPress plugin before 4.1.3 unserializes user input via the Remove Background feature, which could allow Author+ users to perform PHP Object Injection when a suitable gadget is present on the blog...

CVE-2023-5087 PageLayer < 1.7.8 - Author+ Stored XSS

The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code...

CVE-2023-5087 PageLayer < 1.7.8 - Author+ Stored XSS

The Page Builder: Pagelayer WordPress plugin before 1.7.8 doesn't prevent attackers with author privileges and higher from inserting malicious JavaScript inside a post's header or footer code...

WordPress plugin Page Builder: Pagelayer Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

Exploit for CVE-2023-38646

CVE-2023-38646 - Metabase Pre-Auth RCE ⚠️ For educatio...

WP < 6.3.2 - Unauthenticated Post Author Email Disclosure

Description WordPress does not properly restrict which user fields are searchable via the REST API. from multiprocessing import Pool import requests import string import json import sys if lensys.argv != 2: printf'USAGE: sys.argv0 ' sys.exit url = sys.argv1.rstrip'/' + '/wp-json/wp/v2/users'...

Lost And Found Information System 1.0 Insecure Direct Object Reference

Exploit Title: Lost and Found Information System v1.0 - idor leads to Account Take over Date: 2023-12-03 Exploit Author: OR4NG.M4N Category : webapps CVE : CVE-2023-38965 Python p0c : import argparse import requests import time parser = argparse.ArgumentParserdescription='Send a POST request to t...

CITS Support svg, webp Media and TTF,OTF File Upload < 3.0 - Author+ Stored XSS via SVG

Description The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. PoC As an author, upload an SVG with the payload: View the SVG and see the XSS...

CITS Support svg, webp Media and TTF,OTF File Upload < 3.0 - Author+ Stored XSS via SVG

Description The plugin does not sanitise uploaded SVG files, which could allow users with a role as low as Author to upload a malicious SVG containing XSS payloads. As an author, upload an SVG with the payload: alert"xss"; View the SVG and see the XSS...

CVE-2023-41650

Cross-Site Request Forgery CSRF vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin = 2.1 versions...

CVE-2023-41650

Cross-Site Request Forgery CSRF vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin = 2.1 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin = 2.1 versions...

CVE-2023-41650

CVE-2023-41650 describes a CSRF vulnerability in the WordPress plugin Remove/hide Author, Date, Category Like Entry-Meta (versions

CVE-2023-41650 WordPress Remove/hide Author, Date, Category Like Entry-Meta Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin = 2.1 versions...

CVE-2023-41650 WordPress Remove/hide Author, Date, Category Like Entry-Meta Plugin <= 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Venugopal Remove/hide Author, Date, Category Like Entry-Meta plugin = 2.1 versions...

WordPress Plugin Remove/hide Author, Date, Category Like Entry-Meta Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

The vulnerability of the SMTP mail server service in Exim allows a hacker to execute arbitrary code.

The vulnerability of the Exim mail server’s SMTP service relates to the ability to write data beyond the buffer boundaries in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code by injecting the AUTHOR command remotely...

CVE-2023-25989

Summary: CVE-2023-25989 is a CSRF vulnerability reported across multiple Meks WordPress plugins (Audio Player, Time Ago, ThemeForest Smart Widget, Smart Author Widget, Easy Maps, Easy Photo Feed Widget, Simple Flickr Widget, Easy Ads Widget, Smart Social Widget, and related plugins). The flaw ena...

CVE-2023-41662

Unauth. Reflected Cross-Site Scripting XSS vulnerability in Ulf Benjaminsson WP-dTree plugin = 4.4.5 versions...

CVE-2023-43874

Multiple Cross Site Scripting XSS vulnerability in e017 CMS v.2.3.2 allows a local attacker to execute arbitrary code via a crafted script to the Copyright and Author fields in the Meta & Custom Tags Menu...