CVE-2024-3993

The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-3993 AZAN Plugin <= 0.6 - Stored XSS via CSRF

The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-3993

The CVE-2024-3993 entry concerns the AZAN Plugin for WordPress (versions

CVE-2024-3993 AZAN Plugin <= 0.6 - Stored XSS via CSRF

The AZAN Plugin WordPress plugin through 0.6 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

PT-2024-28741 · WordPress · Azan Plugin

Name of the Vulnerable Software and Affected Versions: AZAN Plugin WordPress plugin versions 0.6 and earlier Description: The issue concerns the lack of CSRF checks in certain areas and missing sanitization and escaping, which could allow attackers to inject Stored XSS payloads via a CSRF attack,...

WordPress plugin AZAN security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...

WordPress AZAN plugin <= 0.6 - CSRF Leading to Stored Cross-Site Scripting vulnerability

CSRF Leading to Stored Cross-Site Scripting vulnerability discovered by Bob Matyas in WordPress Plugin AZAN versions = 0.6...

WordPress AZAN Plugin <= 0.6 is vulnerable to Cross Site Request Forgery (CSRF)

Software AZAN Type Plugin Vulnerable versions = 0.6 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-3993 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 4ed17ec41107 Credits Bob Matyas Required privilege...

AZAN Plugin <= 0.6 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack PoC Make a logged in admin open an HTML file containing: If the widget is loaded on a page...

AZAN Plugin <= 0.6 - Stored XSS via CSRF

Description The plugin does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack Make a logged in admin open an HTML file containing: alert999,2,2,3' / If the widget is...

Prayer Now : Azan Prayer Times - Customized SSL, Exported ContentProvider, WebView SSL handling enabled vulnerabilities

HackApp vulnerability scanner discovered that application Prayer Now : Azan Prayer Times published at the 'play' market has multiple vulnerabilities...

Prayer times: Qibla & Azan - Certificates or keys found, Customized SSL, Dynamic Code Loading vulnerabilities

HackApp vulnerability scanner discovered that application Prayer times: Qibla & Azan published at the 'play' market has multiple vulnerabilities...