74 matches found
CVE-2025-32809
InQuizitive (W. W. Norton) is affected by CVE-2025-32809 through 2025-04-08, which allows stored cross-site scripting via user-supplied data in bonus description, feedback.choice_fb[], or question_id. The issue is described across multiple sources as a stored XSS vulnerability; exploitation appea...
Crypto’s rising value likely to bring new wave of scams
With the value of cryptocurrencies going to the roof, you can expect several attempts to get defrauded if you even show the slightest interest in the topic or not. Since most cybercriminals lack creativity and are notoriously lazy, we expect to see only slight variations of old tricks. So, we...
Get Spooked By Huge Scope and Rewards in the Wordfence Bug Bounty Cybersecurity Month Spooktacular Haunt!
Calling all vulnerability researchers! Get ready to immerse yourselves in the world of WordPress security with the Wordfence Cybersecurity Month Spooktacular Haunt , running from now through November 11th, 2024! What's Happening During This Cybersecurity Month Spooktacular Haunt? In celebration o...
CVE-2023-5140
The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-5140
The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
Cross site scripting
The Bonus for Woo WordPress plugin before 5.8.3 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
CVE-2023-5140
The CVE-2023-5140 entry corresponds to the Bonus for Woo WordPress plugin (pre-5.8.3) and is a Reflected Cross-Site Scripting (XSS) vulnerability caused by insufficient sanitisation/escaping of parameters output in pages. Exploitation could target high-privilege users (e.g., admins). Public detai...
WordPress Plugin Bonus for Woo Security Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blog sites on PHP and MySQL servers.WordPress plugin is an...
WordPress Bonus for Woo Plugin <= 5.8.2 is vulnerable to Cross Site Scripting (XSS)
Software Bonus for Woo Type Plugin Vulnerable versions = 5.8.2 Fixed in 5.8.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5140 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID bebc071bb4a6 Credits Enrico Marcolini...
Bonus for Woo < 5.8.3 - Reflected Cross-Site Scripting
Description The plugin does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Make a logged in admin open one of the URL below...
HackerOne: Able to see Bonus amount given to a report even if the bounty and Bonus is not visible to public or mentioned in {Report-Id}.json
A vulnerability allowed users to see the bonus amount given to a report, even if the bounty and bonus were not visible to the public or mentioned in the report's JSON file. This resulted in the exposure of confidential information...
LiquidationQueue brings centralization risk in the contract.
Lines of code Vulnerability details Impact the owner has too much unilateral control over liquidations and can manipulate te country in the following ways: The owner of LiquidationQueue sees a profitable liquidation opportunity Before anyone else can liquidate, they use LiquidationQueue to place ...
HackerOne: Register & create a ticket as somebody else on HackerOne Support
A vulnerability was discovered on HackerOne Support that allowed an attacker to register and create tickets as different individuals. The issue was resolved by adjusting a setting in the Freshdesk Software...
AD Manager Plus 7122 - Remote Code Execution (RCE)
Exploit Title: AD Manager Plus 7122 - Remote Code Execution RCE Exploit Author: Chan Nyein Wai & Thura Moe Myint Vendor Homepage: https://www.manageengine.com/products/ad-manager/ Software Link: https://www.manageengine.com/products/ad-manager/download.html Version: Ad Manager Plus Before 7122...
Increasing the Lock Amount on an Expired Lock Will Cause Users to Miss Out on Rewards
Lines of code Vulnerability details Impact Paladin protocol allows users to increase the amount or duration of their lock while it is stil active. Increasing the amount of an active lock should only increase the total locked amount and it shouldn't make any changes to the associated bonus ratios ...
QA Report
Paladin Contest March 31, 2022 @securerodd Non-Critical 1. Inconsistent Removal of Bonus Multiplier The bonus multipliers userCurrentBonusRatiouser and userBonusRatioDecreaseuser are zeroed out in the kickaddress user, address kicker and unlockaddress user functions where an empty lock is set...
The Changing Face of Loyalty Programs Amid and Post-COVID-19
COVID-19 has undoubtedly prompted the Hospitality and Travel industry into a new era of customer loyalty. Currently, "shelter in place" or similar nonessential travel bans are instituted by many countries and companies across the world. Once travel restrictions are lifted, there will be a...
bonus-online.ru Cross Site Scripting vulnerability OBB-1232630
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
GUnet OpenEclass E-learning platform 1.7.3 - 'uname' SQL Injection
Exploit Title: GUnet OpenEclass E-learning platform 1.7.3 - 'uname' SQL Injection Google Dork: intext:"© GUnet 2003-2007" Date: 2019-11-03 Exploit Author: emaragkos Vendor Homepage: https://www.openeclass.org/ Software Link: http://download.openeclass.org/files/1.7/eclass-1.7.3.tar.gz Version:...
Download: The 2020 Cybersecurity Salary Survey Results
The 2020 Cybersecurity Salary Survey was an online survey published in The Hacker News and created to provide insight into the details related to cybersecurity compensation. There were over 1,500 security professionals who completed the survey. Today you can access the aggregated and analyzed 202...