Improper access control

The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data...

kw.theutilityjob.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-973853 Security Researcher garletmarco Helped patch 1540 vulnerabilities Received 4 Coordinated Disclosure badges , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting kw.theutilityjob.com website and its users. Followi...

bh.theoilandgasjob.com Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-973222 Security Researcher garletmarco Helped patch 1540 vulnerabilities Received 4 Coordinated Disclosure badges , a holder of 4 badges for responsible and coordinated disclosure, found a security vulnerability affecting bh.theoilandgasjob.com website and its users...

wwwext.tsurumi.toshiba.co.jp Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-968307 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

yeekit.com Cross Site Scripting vulnerability

Security Researcher geeknik Helped patch 8635 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting yeekit.com website and its users. Following coordinated an...

shbarcelona.fr Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-958772 Security Researcher geeknik Helped patch 8938 vulnerabilities Received 8 Coordinated Disclosure badges Received 21 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting shbarcelona.fr website and...

WordPress bold-page-builder plugin has unspecified vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. bold-page-builder is a drag-and-drop page builder plugin used in it. A security vulnerability exists in WordPress bold-page-builder...

budgetpromotions.com.au Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-952558 Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website...

strip-curtains.com Open Redirect vulnerability

Security Researcher k0t Helped patch 2130 vulnerabilities Received 9 Coordinated Disclosure badges Received 95 recommendations , a holder of 9 badges for responsible and coordinated disclosure, found a security vulnerability affecting strip-curtains.com website and its users. Following coordinate...

CVE-2019-14749

Summary: CVE-2019-14749 affects osTicket before 1.10.7 and 1.12.x before 1.12.1, where the export spreadsheets feature can inject formulas (CSV/XLS) via unvalidated input in Name/Internal Notes (Users tab) and Issue Summary (Tickets tab). This can cause a Formula Injection in downloaded spreadshe...

www2.cmovieshd.bz Cross Site Scripting vulnerability

Open Bug Bounty ID: OBB-899416 Security Researcher geeknik Helped patch 8696 vulnerabilities Received 8 Coordinated Disclosure badges Received 20 recommendations , a holder of 8 badges for responsible and coordinated disclosure, found a security vulnerability affecting www2.cmovieshd.bz website a...

leports114.com Cross Site Scripting vulnerability

Security Researcher calv1n Helped patch 22043 vulnerabilities Received 12 Coordinated Disclosure badges Received 37 recommendations , a holder of 12 badges for responsible and coordinated disclosure, found a security vulnerability affecting leports114.com website and its users. Following...

MISP - Malware Information Sharing Platform and Threat Sharing

The objective of MISP is to foster the sharing of structured information within the security community and abroad. MISP provides functionalities to support the exchange of information but also the consumption of the information by Network Intrusion Detection System NIDS, LIDS but also log analysi...

WordPress Plugin Ninja Forms 3.3.13 - CSV Injection

Exploit Title: Wordpress Plugin Ninja Forms 3.3.13 - CSV Injection Exploit Author: Mostafa Gharzi Website: https://www.certcc.ir Date: 2018-08-19 Google Dork: N/A Vendor: The WP Ninjas Software Link: https://wordpress.org/plugins/ninja-forms/ Affected Version: 3.3.13 and before Active...

Export Users to CSV <= 1.1.1 - CSV Injection

WordPress Export users to CSV plugin version 1.1.1. and before are affected by Remote Code Execution through the CSV injection vulnerability. This allows an application user to inject commands as part of the fields of his profile and these commands are executed when a user with greater privilege...

WordPress Plugin Export Users to CSV 1.1.1 - CSV Injection

Exploit Title: Wordpress Plugin Export Users to CSV 1.1.1 - CSV Injection Exploit Author: Javier Olmedo Website: https://hackpuntes.com Date: 2018-08-14 Google Dork: N/A Vendor: Matt Cromwell Software Link: https://wordpress.org/plugins/export-users-to-csv/ Affected Version: 1.1.1 and before Acti...

Wordpress Advanced Order Export For WooCommerce Plugin < 1.5.4 - CSV Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Advanced Order Export For WooCommerce 1.5.4 - CSV Injection Exploit Author: Bhushan B. Patil Software Link: https://wordpress.org/plugins/woo-order-export-lite/ Affected Version: 1.5.4 and before Category: Plugi...

WordPress Plugin Advanced Order Export For WooCommerce < 1.5.4 - CSV Injection

Exploit Title: Wordpress Plugin Advanced Order Export For WooCommerce 1.5.4 - CSV Injection Google Dork: N/A Date: 2018-06-24 Exploit Author: Bhushan B. Patil Software Link: https://wordpress.org/plugins/woo-order-export-lite/ Affected Version: 1.5.4 and before Category: Plugins and Extensions...

SQL Injection Vulnerability in Longcai Technology Cms

Longcai Technology Group is a high-tech enterprise with website construction, network promotion, network engineering construction, software development, computer maintenance and multimedia video production as its main business. Longcai Technology Cms has a SQL injection vulnerability. Attackers c...

SQL Injection Vulnerability in Guangzhou Lianxiang Cms

Guangzhou Lianxiang Information Technology Co., Ltd. is an e-commerce Internet enterprise that specializes in website construction, micro letter development and website development. Guangzhou Lianxiang CMS has a SQL injection vulnerability. Attackers can use the vulnerability to perform malicious...