CVE-2021-24581

The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited...

Cross site scripting

The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited...

CVE-2021-24581

CVE-2021-24581 concerns the WordPress plugin Blue Admin (

CVE-2021-24581 Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)

The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited...

WordPress plugin Blue Admin 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

The vulnerability of the Ethernet Download function in Schneider Electric’s HMI terminal configuration software, EcoStruxure Operator Terminal Expert, and the SCADA software Pro-face BLUE, related to insufficient validation of input data, allows a perpetrator to execute arbitrary codes.

The vulnerability of the Ethernet Download function in Schneider Electric’s HMI terminal configuration software, EcoStruxure Operator Terminal Expert, and the SCADA software Pro-face BLUE is related to insufficient validation of input data. Exploiting this vulnerability could allow a remote...

Exploit for OS Command Injection in Sophos Unified_Threat_Management

sophucked CVE-2020-25223 RCE PoC, gets reverse shell. Pre-auth...

REW-sploit - Emulate And Dissect MSF And *Other* Attacks

REW-sploit The tool has been presented at Black-Hat Arsenal USA 2021 https://www.blackhat.com/us-21/arsenal/schedule/index.htmlrew-sploit-dissecting-metasploit-attacks-24086 Slides of presentation are available at https://github.com/REW-sploit/REW-sploitdocs Need help in analyzing Windows shellco...

Blue Admin <= 21.06.01 - CSRF to Stored Cross-Site Scripting (XSS)

The plugin does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack. PoC Add the...

WordPress Blue Admin plugin <= 21.06.01 - Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)

Cross-Site Request Forgery CSRF leading to Stored Cross-Site Scripting XSS discovered by ABISHEIK M in WordPress Blue Admin plugin versions = 21.06.01. Solution Deactivate and delete. This plugin has been closed as of May 28, 2021 and is not available for download. Reason: Security Issue...

Metasploit Wrap-Up

Eternal Blue improvements Prior to this release Metasploit offered two separate exploit modules for targeting MS17-010, dubbed Eternal Blue. The Ruby module previously only supported Windows 7, and a separate ms17010eternalbluewin8 Python module would target Windows 8 and above. Now Metasploit...

SQL Injection Vulnerability in Blue Ocean Premier Billing Management System (CNVD-2021-51859)

Blue Ocean Premier Billing Management System is a network security operation management system that is based on realizing network operation, centering on enhancing global security, and aiming at improving management efficiency. The Blue Ocean Excellence Billing Management System suffers from a SQ...

Microsoft Windows 10 suffers from a denial of service vulnerability (CNVD-2021-48958)

Microsoft Windows 10 is a set of operating systems for use on personal computers. A denial of service vulnerability exists in Microsoft Windows 10. An attacker can exploit the vulnerability to cause the operating system to blue screen...

Binary Vulnerability in IT Helpers of Suning.com Group Co.

IT Helper is a comprehensive computer management software. Suning.com Group Inc IT Helper has a binary vulnerability that can be exploited by attackers to cause a blue screen on a computer...

Swift-Attack - Unit Tests For Blue Teams To Aid With Building Detections For Some Common macOS Post Exploitation Methods

Unit tests for blue teams to aid with building detections for some common macOS post exploitation methods. I have included some post exploitation examples using both command line history and on disk binaries which should be easier for detection as well as post exploitation examples using API call...

Memory Corruption Vulnerability in Blue Mountain PDF Reader

Blue Mountain PDF Reader is Shanghai Blue Mountain Office Software Co., Ltd. developed a highly efficient PDF reader, including PDF reading, merging, conversion, adding watermarks and other functions. Blue Hill PDF Reader memory corruption vulnerability, attackers can use the vulnerability caused...

Arbitrary File Download Vulnerability in Blue Shield Firewall of Blue Shield Information Security Technology Co.

Blue Shield Information Security Technology Co., Ltd. is the earliest professional network security enterprise engaged in the research and development, production and sales of information security products with independent intellectual property rights in China. Blue Shield Information Security...

Arbitrary File Deletion Vulnerability in Blue Ocean Premier Billing Management System

Blue Ocean Premier Billing Management System is a network security operation management system that is based on realizing network operation, centering on enhancing global security, and aiming at improving management efficiency. The Blue Ocean Excellence Billing Management System has an arbitrary...

SQL Injection Vulnerability in Blue Ocean Premier Billing Management System (CNVD-2021-43937)

Blue Ocean Premier Billing Management System is a network security operation management system that is based on realizing network operation, centering on enhancing global security and improving management efficiency. The Blue Ocean Excellence Billing Management System suffers from a SQL injection...

How purple teams can embrace hacker culture to improve security

The security community is continuously changing, growing, and learning from each other to better position the world against cyber threats. In the latest Voice of the Community blog series post, Microsoft Product Marketing Manager Natalia Godyla talks with Matthew Hickey, co-founder, CEO, and writ...