WordPress plugin SQL注入漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers.The WordPress WPcalc plugin in version 2.1 and earlier is vulnerable to SQL injection, which stems from the plugin'...

CVE-2021-24628

The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection...

CVE-2021-24628

The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection...

CVE-2021-24631: Improper Neutralization of Special Elements used in an SQL Command

The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as low as editor, leading to an authenticated SQL Injection...

CVE-2021-24628: Improper Neutralization of Special Elements used in an SQL Command

The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. WordPress Unlimited PopUps plugin in version 4.5.3 and earlier suffers from a SQL injection vulnerability that...

WordPress SQL注入漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress Wow Forms plugin in version 3.1.3 and earlier, which stems fr...

CVE-2021-42043: Improper Neutralization of Input During Web Page Generation

An issue was discovered in Special:MediaSearch in the MediaSearch extension in MediaWiki through 1.36.2. The suggestion text a parameter to mediasearch-did-you-mean was not being properly sanitized and allowed for the injection and execution of HTML and JavaScript via the intitle: search operator...

PT-2021-15884

Name of the Vulnerable Software and Affected Versions Side Menu – add fixed side buttons WordPress plugin versions prior to 3.1.5 Description The issue concerns the menu delete functionality, which is accessible to Administrator users. It takes the did GET parameter and uses it in an SQL statemen...

CVE-2021-24348: Improper Neutralization of Special Elements used in an SQL Command

The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue...

Microsoft Says SolarWinds Hackers Accessed Some of Its Source Code

Microsoft on Thursday revealed that the threat actors behind the SolarWinds supply chain attack were able to gain access to a small number of internal accounts and escalate access inside its internal network. The "very sophisticated nation-state actor" used the unauthorized access to view, but no...

Authentic Credentials Recreation

vp-toolkit is vulnerable to authentic credentials recreation. The verifyVerifiableCredential function fails to correctly verify the credential.issuer DID against the signer of the credential during its cryptographic level integerity check, allowing a malicious holder of the credential to recreate...

GHSA-P94W-42G3-F7H4 Holder can (re)create authentic credentials after receiving a credential in vp-toolkit

Impact The verifyVerifiableCredential method check the cryptographic integrity of the Verifiable Credential, but it does not check if the credential.issuer DID matches the signer of the credential. The verifier is impacted by this vulnerability. Patches Patch will be available in version 0.2.2...

GHSA-FF5X-W9WG-H275 Holder can generate proof of ownership for credentials it does not control in vp-toolkit

Impact The verifyVerifiablePresentation method check the cryptographic integrity of the Verifiable Presentation, but it does not check if the credentialSubject.id DID matches the signer of the VP proof. The verifier is impacted by this vulnerability. Patches Patch will be available in version...

Wansview 1.0.2 - Denial of Service (PoC)

Exploit Title: Wansview 1.0.2 - Denial of Service PoC Author: Gionathan "John" Reale Discovey Date: 2018-08-14 Software Link: http://www.wansview.com/uploads/soft/Wansviewv1.0.2.exe Tested Version: 1.0.2 Tested on OS: Windows 10 Steps to Reproduce: Run the python exploit script, it will create a...

iSmartViewPro 1.5 - Account Buffer Overflow

iSmartViewPro 1.5 - Account Buffer Overflow Exploit Title: iSmartViewPro 1.5 - 'Account' Buffer Overflow Discovery by: Alan Joaquín Baeza Meza Discovery Date: 2018-08-07 Vendor Homepage: http://www.securimport.com/n/en/ Software Link:...

did-card.co.uk XSS vulnerability

Open Bug Bounty ID: OBB-459105 Description| Value ---|--- Affected Website:| did-card.co.uk Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1 CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N Remediation Guide:| OWASP XSS Prevention Cheat...

CVE-2016-7326

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: The CNA or individual who requested this candidate did not associate it with any vulnerability during 2016. Notes: none...

CVE-2016-8593

Directory traversal vulnerability in upload.cgi in Trend Micro Threat Discovery Appliance 2.6.1062r1 and earlier allows remote authenticated users to execute arbitrary code via a .. dot dot in the dID parameter...

Joomla com_registrationpro plugin 'did' parameter SQL injection vulnerability

Joomla is an open source content management system CMS. A SQL injection vulnerability exists in the 'did' parameter of the Joomla comregistrationpro plugin. An attacker can exploit the vulnerability to access or modify database data...