225 matches found
PT-2024-21973
Name of the Vulnerable Software and Affected Versions CMS Made Simple version 2.2.19 Description The issue is related to Server-Side Template Injection SSTI within the Design Manager, specifically when editing the Breadcrumbs. Recommendations For CMS Made Simple version 2.2.19, consider disabling...
CMS Made Simple 2.2.19 Server-Side Template Injection Vulnerability
Exploit Title: CMS Made Simple Version: 2.2.19 - SSTI Exploit Author: tmrswrr Vendor Homepage: https://www.cmsmadesimple.org/ Version: 2.2.19 Tested on: https://www.softaculous.com/demos/CMSMadeSimple 1 log in as admin and go to Layout Design Manager Breadcrumbs 2 Click edit and write SSTI payloa...
CMS Made Simple 2.2.19 Server-Side Template Injection
Exploit Title: CMS Made Simple Version: 2.2.19 - SSTI Date: 2024-21-02 Exploit Author: tmrswrr Vendor Homepage: https://www.cmsmadesimple.org/ Version: 2.2.19 Tested on: https://www.softaculous.com/demos/CMSMadeSimple 1 log in as admin and go to Layout Design Manager Breadcrumbs 2 Click edit and...
PT-2023-29223 · Zope · Zope
Name of the Vulnerable Software and Affected Versions: Zope versions prior to 4.8.11 Zope versions prior to 5.8.6 Description: Zope is an open-source web application server. The title property, available on most Zope objects, can be used to store script code that is executed while viewing the...
CVE-2023-3708
Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...
CVE-2023-3708
Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...
Cross site scripting
Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...
CVE-2023-3708 Multiple DeoThemes Themes <= (Various Versions) - Reflected Cross-Site Scripting
Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...
PT-2023-25786
Name of the Vulnerable Software and Affected Versions DeoThemes WordPress themes affected versions not specified Description The issue is related to Reflected Cross-Site Scripting via breadcrumbs in various versions of DeoThemes WordPress themes. This is due to insufficient input sanitization and...
CVE-2023-3708: Improper Neutralization of Input During Web Page Generation
Several themes for WordPress by DeoThemes are vulnerable to Reflected Cross-Site Scripting via breadcrumbs in various versions due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if...
SUSE CVE-2014-2022
SQL injection vulnerability in includes/api/4/breadcrumbscreate.php in vBulletin 4.2.2, 4.2.1, 4.2.0 PL2, and earlier allows remote authenticated users to execute arbitrary SQL commands via the conceptid argument in an xmlrpc API request...
Malicious code in react-advanced-breadcrumbs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43ca4841853fdec8c951bcbb886eb3fbf01574178c614c25db2ed6a608d31d45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2023-723 Malicious code in react-advanced-breadcrumbs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 43ca4841853fdec8c951bcbb886eb3fbf01574178c614c25db2ed6a608d31d45 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious Package
Overview react-advanced-breadcrumbs is a malicious package. The package's name is based on existing repositories, namespaces, or components used by popular companies in an effort to trick employees into downloading it, also known as 'dependency confusion'. Therefore, you're only vulnerable if thi...
MAL-2022-307 Malicious code in @harrysforge/breadcrumbs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04fc6d7318c70cffd2f0f403f7ae0bb9f9ec22a226732797d22f2e43a00e0e13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
Malicious code in @harrysforge/breadcrumbs (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 04fc6d7318c70cffd2f0f403f7ae0bb9f9ec22a226732797d22f2e43a00e0e13 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs
The plugin does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed. PoC As admin, put the following payload in the Breadcrumb...
WP Meta SEO < 4.4.7 - Admin+ Stored Cross-Site Scripting via breadcrumbs
The plugin does not sanitise or escape the breadcrumb separator before outputting it to the page, allowing a high privilege user such as an administrator to inject arbitrary javascript into the page even when unfiltered html is disallowed. As admin, put the following payload in the Breadcrumb...
DRUPAL-CONTRIB-2022-024
The Custom Breadcrumbs module provides a variety of options for customizing the breadcrumb trail. The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...
PT-2022-38343
The Custom Breadcrumbs module provides a variety of options for customizing the breadcrumb trail. The module doesn't sufficiently filter on output, leading to a Cross Site Scripting vulnerability. This vulnerability is mitigated by the fact that an attacker must have a role with the permission...