182 matches found
Custom Content Shortcode < 4.0.2 - Authenticated Stored Cross-Site Scripting
The plugin does not escape custom fields before outputting them, which could allow Contributor+ v Preferences Panels and enable the Custom Fields, such as testxss with a value of Then add the following shortcode to the post field testxss and view/preview it to trigger the XSS...
WordPress Custom Content Shortcode plugin <= 3.8.9 - Unauthorized Arbitrary Post Metadata Access vulnerability
Unauthorized Arbitrary Post Metadata Access vulnerability discovered by Francesco Carlucci in WordPress Custom Content Shortcode plugin versions = 3.8.9. Solution Update the WordPress Custom Content Shortcode plugin to the latest available version at least 4.0.0...
Custom Content Shortcode < 4.0.2 - Authenticated Arbitrary File Access / LFI
The plugin does not validate the data passed to its load shortcode, which could allow Contributor+ v 4.0.1 or Admin+ v 4.0.2 users to display arbitrary files from the filesystem such as logs, .htaccess etc, as well as perform Local File Inclusion attacks as PHP files will be executed. Please note...
WordPress Custom Content Shortcode plugin <= 4.0.1 - Authenticated Arbitrary File Access / Local File Inclusion (LFI) vulnerability
Authenticated Arbitrary File Access / Local File Inclusion LFI vulnerability discovered by Francesco Carlucci in WordPress Custom Content Shortcode plugin versions = 4.0.1. Solution Update the WordPress Custom Content Shortcode plugin to the latest available version at least 4.0.2...
WordPress Custom Content Shortcode plugin <= 3.8.9 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability
Authenticated Reflected Cross-Site Scripting XSS vulnerability discovered in WordPress Custom Content Shortcode plugin versions = 3.8.9. Solution Update the WordPress Custom Content Shortcode plugin to the latest available version at least 4.0.0...
CVE-2021-24338: Improper Neutralization of Input During Web Page Generation
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting XSS security vulnerability within the 'Singular Label' field parameter...
CVE-2021-24339: Improper Neutralization of Input During Web Page Generation
The Pods – Custom Content Types and Fields WordPress plugin before 2.7.27 was vulnerable to an Authenticated Stored Cross-Site Scripting XSS security vulnerability within the 'Menu Label' field parameter...
PT-2021-15875
Name of the Vulnerable Software and Affected Versions The Pods – Custom Content Types and Fields WordPress plugin versions prior to 2.7.27 Description The issue concerns an Authenticated Stored Cross-Site Scripting XSS security problem. It is located within the 'Menu Label' field parameter...
Five Ways Bad Bots Are Threatening Financial Services
For years now, the biggest security concerns for businesses in the financial services sector have mainly been related to data security, privacy, compliance and everything in between. Nevertheless, application security is equally as important and complex, as it consists of multiple potential attac...
WordPress Popup Builder plugin <= 3.71 - Authenticated Newsletter Send With Custom Content And Sender vulnerability
Authenticated Newsletter Send With Custom Content And Sender vulnerability found by Dave Jong WebARX Security in WordPress Popup Builder plugin versions = 3.71. Solution Update the WordPress Popup Builder plugin to the latest available version at least 3.72...
[SECURITY] Fedora 28 Update: drupal7-link-1.6-1.fc28
The link module can be count to the top 50 modules in Drupal installations and provides a standard custom content field for links. With this module links can be added easily to any content types and profiles and include advanced validating and different ways of storing internal or external links...
CVE-2018-11580
An issue was discovered in mass-pages-posts-creator.php in the MULTIDOTS Mass Pages/Posts Creator plugin 1.2.2 for WordPress. Any logged in user can launch Mass Pages/Posts creation with custom content. There is no nonce or user capability check, so anyone can launch a DoS attack against a site a...
hBlock - Improve Your Security And Privacy By Blocking Ads, Tracking And Malware Domains
Improve your security and privacy by blocking ads, tracking and malware domains. What is this for? This POSIX-compliant shell script, designed for Unix-like systems, gets a list of domains that serve ads, tracking scripts and malware from multiple reputable sources and creates a hosts file that...
Oracle MySQL 5.5.x < 5.5.53 Multiple Vulnerabilities
Binary data 9747.prm...
WordPress Custom Content Type Manager Plugin <= 0.9.8.8 - Multiple Vulnerabilities
This plugin is prone to malicious changes, scenario attacking and others vulnerabilities. Solution Updating is not enough to clean the site. Please check the "Mitigation" section at the end of this blogpost -- https://blog.sucuri.net/2016/03/when-wordpress-plugin-goes-bad.html...
[SECURITY] Fedora 21 Update: drupal6-cck-2.10-1.fc21
The Content Construction Kit allows you to add custom fields to custom content types using a web interface. In Drupal 5.x, custom content types can be created in Drupal core, and the Content Construction Kit allows you to add custom fields to any content type. In Drupal 7 and later, most of the...
[SECURITY] Fedora 22 Update: drupal7-ctools-1.7-1.fc22
This suite is primarily a set of APIs and tools to improve the developer experience. It also contains a module called the Page Manager whose job is to manage pages. In particular it manages panel pages, but as it grows it will be able to manage far more than just Panels. For the moment, it includ...
Code injection
atdownload.py in Plone before 4.2.3 and 4.3 before beta 1 allows remote attackers to read arbitrary BLOBs Files and Images stored on custom content types via a crafted URL...
