CVE-2023-38390

CVE-2023-38390 is a Cross-Site Request Forgery (CSRF) vulnerability in the WordPress plugin Anshul Labs Mobile Address Bar Changer (versions ≤ 3.0). The issue arises from CSRF in the plugin’s settings update flow, allowing an unauthenticated attacker to induce a user to perform unintended actions...

WordPress Plugin mobile-address-bar-changer Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site request forgery vulnerability...

PT-2023-26399 · Anshul · Anshul Labs Mobile Address Bar Changer

Name of the Vulnerable Software and Affected Versions: Anshul Labs Mobile Address Bar Changer plugin versions = 3.0 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintended actions on a web...

WordPress Mobile Address Bar Changer Plugin <= 3.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Mobile Address Bar Changer Type Plugin Vulnerable versions = 3.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-38390 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 8cf3f99225d5 Credits Skalucy...

IT threat evolution Q1 2023

IT threat evolution in Q1 2023 IT threat evolution in Q1 2023. Non-mobile statistics IT threat evolution in Q1 2023. Mobile statistics Targeted attacks BlueNoroff introduces new methods bypassing MotW At the close of 2022, we reported the recent activities of BlueNoroff, a financially motivated...

WordPress LH Password Changer Plugin <= 1.55 is vulnerable to Cross Site Request Forgery (CSRF)

Software LH Password Changer Type Plugin Vulnerable versions = 1.55 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-34182 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 19a12f4b7744 Credits Mika Required...

CVE-2023-25795

Auth. admin+ Cross-Site Scripting XSS vulnerability in WP-master.Ir Feed Changer & Remover plugin = 0.2 versions...

CVE-2023-25795

Auth. admin+ Cross-Site Scripting XSS vulnerability in WP-master.Ir Feed Changer & Remover plugin = 0.2 versions...

CVE-2023-25795

Auth. (admin+) Cross-Site Scripting (XSS) in WP-master.Ir Feed Changer & Remover plugin

CVE-2023-25795 WordPress Feed Changer Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Cross-Site Scripting XSS vulnerability in WP-master.Ir Feed Changer & Remover plugin = 0.2 versions...

CVE-2023-25795 WordPress Feed Changer Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Cross-Site Scripting XSS vulnerability in WP-master.Ir Feed Changer & Remover plugin = 0.2 versions...

WordPress Plugin master.Ir Feed Changer & Remover 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

SUSE CVE-2017-6842

The ColorChanger::GetColorFromStack function in colorchanger.cpp in PoDoFo 0.9.5 allows remote attackers to cause a denial of service NULL pointer dereference via a crafted file...

WordPress Feed Changer Plugin <= 0.2 is vulnerable to Cross Site Scripting (XSS)

Software Feed Changer Type Plugin Vulnerable versions = 0.2 Fixed in 0.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25795 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 278406b3155b Credits Rio Darmawan Required privileg...

Roaming Mantis Malware Returns with DNS Changer Capability

By Deeba Ahmed Roaming Mantis malware was last seen in April 2018 targeting iOS and Android devices with cryptocurrency mining malware but this time, it has new DNS changer capabilities. This is a post from HackRead.com Read the original post: Roaming Mantis Malware Returns with DNS Changer...

Roaming Mantis implements new DNS changer in its malicious mobile app in 2022

Roaming Mantis a.k.a Shaoye is well-known as a long-term cyberattack campaign that uses malicious Android package APK files to control infected Android devices and steal device information; it also uses phishing pages to steal user credentials, with a strong financial motivation. Kaspersky has be...

WordPress Automatic Domain Changer plugin <= 2.0.2 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Automatic Domain Changer plugin versions = 2.0.2. Solution Update the WordPress Automatic Domain Changer plugin to the latest available version at least 2.0.3...

Jatayu - Stealthy Stand Alone PHP Web Shell

JATAYU Stealthy Stand Alone PHP Web Shell FEATURES Http Header Based Authentication. 100% Undetectable. Exec Function Changer. Nothing Fancy USAGE GET /test/jatayu.php?fn=1&&cmd=whoami Host : http://test.com Authtoken : bb3b1a1f-0447-42a6-955a-88681fb88499 FUNCTIONS PARAMETER | FUNCTION ---|---...

WordPress WP Admin Logo Changer plugin cross-site request forgery vulnerability

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. WP Admin Logo Changer plugin is a WordPress open source application plugin. WordPress WP Admin Logo Changer plugin in version 1.0 and earlier has a cross-site request forgery vulnerability, which...

CVE-2021-24784

The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack...