Lack of check for fee tokens

Lines of code Vulnerability details Impact The lendToProject function will receive the cost as an argument. However, some tokens will charge a fee, which might cause the balance of the token in the contract mismatch the cost. File: contracts/Project.sol /// @inheritdoc IProject function...

CVE-2022-2215

The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-2215

The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-2215

The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...

Cross site scripting

The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-2215 GiveWP < 2.21.3 - Admin+ Stored Cross-Site Scripting

The GiveWP WordPress plugin before 2.21.3 does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup...

Attacker can steal all the wrapped tokens, ether or native currency contained in the ReceiverImplementation contract

Lines of code Vulnerability details Impact since all the functions in the ReceiverImplemention are all designed to be called by DepositBase and AxelarDepositService, why not create a simple modifer to check if msg.sender equals either of the two when a delegatecall or call occurs, like so modifie...

WordPress plugin GiveWP 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

GiveWP < 2.21.3 - Admin+ Stored Cross-Site Scripting

The plugin does not properly sanitise and escape the currency settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks when the unfilteredhtml capability is disallowed for example in multisite setup PoC Get a REST nonce logged in as admin:...

Information Disclosure

kgexplore is vulnerable to information disclosure. An attacker can inject and execute malicious code through the request package and gain access to sensitive user information and digital currency keys...

Information Disclosure

rondoluytconcate is vulnerable to information disclosure. An attacker can inject and execute malicious code through the request package and gain access to sensitive user information and digital currency keys...

Remote Code Execution (RCE)

aamiles is vulnerable to remote code execution. The use of the request package opens up a code execution backdoor, allowing an attacker to perform unauthorized actions and accesses to sensitive information and digital currency keys...

Information Disclosure

rootinteractive is vulnerable to information disclosure. An attacker can inject and execute malicious code through the request package and gain access to sensitive user information and digital currency keys...

Information Disclosure

drwebengine is vulnerable to information disclosure. An attacker can inject and execute malicious code through the request package and gain access to sensitive user information and digital currency keys...

Remote Code Execution (RCE)

sixfabtool is vulnerable to remote code execution. When the package is installed, it opens a malicious backdoor in the package allowing an attacker to inject and execute arbitrary codes and gain access to sensitive user information and digital currency keys as well as escalate privileges...

Remote Code Execution (RCE)

djangonavbarclient is vulnerable to remote code execution. When the package is installed, it opens a malicious backdoor in the package allowing an attacker to inject and execute arbitrary codes and gain access to sensitive user information and digital currency keys as well as escalate privileges...

Remote Code Execution (RCE)

texercise is vulnerable to remote code execution. When the package is installed, it opens a malicious backdoor in the package allowing an attacker to inject and execute arbitrary codes and gain access to sensitive user information and digital currency keys as well as escalate privileges...

Information Disclosure

perdido is vulnerable to information disclosure. An attacker can inject and execute malicious code through the request package and gain access to sensitive user information and digital currency keys...

Remote Code Execution Backdoor

zibal is vulnerable to remote code execution. The use of the request package opens up a code execution backdoor, allowing an attacker to perform unauthorized actions and accesses to sensitive information and digital currency keys...

Remote Code Execution Backdoor

cloudlabeling is vulnerable to remote code execution. The use of the request package opens up a code execution backdoor, allowing an attacker to perform unauthorized actions and accesses to sensitive information and digital currency keys...