CVE-2019-15648: Improper Limitation of a Pathname to a Restricted Directory

The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber...

CVE-2019-15649: Unrestricted Upload of File with Dangerous Type

The insert-or-embed-articulate-content-into-wordpress plugin before 4.2999 for WordPress has insufficient restrictions on file upload...

PT-2019-14320

Name of the Vulnerable Software and Affected Versions insert-or-embed-articulate-content-into-wordpress plugin versions prior to 4.29991 Description The issue is related to insufficient restrictions on deleting or renaming content by a Subscriber. Recommendations For versions prior to 4.29991,...

WordPress embed-comment-images plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. embed-comment-images is a plugin that supports embedding image links in comments. A cross-site scripting vulnerability exists in the...

CVE-2017-18561

The embed-comment-images plugin before 0.6 for WordPress has XSS...

CVE-2017-18561

The embed-comment-images plugin before 0.6 for WordPress has XSS...

CVE-2017-18561

The CVE-2017-18561 entry concerns the WordPress plugin embed-comment-images with an XSS vulnerability in versions before 0.6. Connected sources consistently describe Cross-Site Scripting in this plugin, evidenced by references noting XSS and a PoC demonstrating an image tag-based vector (e.g., un...

CVE-2017-18561: Improper Neutralization of Input During Web Page Generation

The embed-comment-images plugin before 0.6 for WordPress has XSS...

PT-2019-8495

Name of the Vulnerable Software and Affected Versions WordPress embed-comment-images plugin versions prior to 0.6 Description The issue allows for cross-site scripting XSS attacks. Recommendations For versions prior to 0.6, update the embed-comment-images plugin to version 0.6 or later to resolve...

WordPress Real Estate Theme 2.8.9 Cross Site Scripting

Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9 Persistent XSS Injection Google Dork: inurl:"/wp-content/themes/realestate-7/" Date: 2019/07/20 Author: m0ze Vendor Homepage: https://contempothemes.com Software Link:...

WordPress Theme Real Estate 2.8.9 - Cross-Site Scripting

WordPress Theme Real Estate 2.8.9 - Cross-Site Scripting Exploit Title: Real Estate 7 - Real Estate WordPress Theme v2.8.9 Persistent XSS Injection Google Dork: inurl:"/wp-content/themes/realestate-7/" Date: 2019/07/20 Author: m0ze Vendor Homepage: https://contempothemes.com Software Link:...

CVE-2019-1010091

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab...

CVE-2019-1010091

Removed by vendor...

CVE-2019-1010091: Improper Neutralization of Input During Web Page Generation

tinymce 4.7.11, 4.7.12 is affected by: CWE-79: Improper Neutralization of Input During Web Page Generation. The impact is: JavaScript code execution. The component is: Media element. The attack vector is: The victim must paste malicious content to media element's embed tab...

Khan Academy: RTL override char allowed at khanacademy redirect page

Summary Attacker can embed RTLO character at the following URL https://www.khanacademy.org/computer-programming/linkredirector?url= to trick the user to download suspicious files. Steps to reproduce Visit https://www.khanacademy.org/computer-programming/linkredirector?url= add the following paylo...

Insert or Embed Articulate Content into WordPress plugin <= 4.2998 - Authenticated Remote Code Execution (RCE) vulnerability

Authenticated Remote Code Execution RCE vulnerability found in Insert or Embed Articulate Content into WordPress plugin versions = 4.2998. Solution Update the Insert or Embed Articulate Content into WordPress plugin to the latest available version at least 4.2999...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3525 more potentially affected by CVE-2019-10072 via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.40)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2019-10072 Source...

ai.ylyue:yue-library-base (>=finchley.sr2.sr1, <=finchley.sr4.1), ai.ylyue:yue-library-base-crypto (>=finchley.sr4, <=finchley.sr4.1) +3525 more potentially affected by CVE-2019-0199 +1 more via org.apache.tomcat.embed:tomcat-embed-core (>=8.5.0, <=8.5.40)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =8.5.0, =finchley.sr2.sr1, =finchley.sr4, =finchley.sr2.sr1, =finchley.sr2.sr1, =finchley.sr4, =1.0.0, =0.0.2, =0.0.3, =1, =1, =1, =1, =1, =10 - be.ordina:microservices-dashboard-server 1.0.1 and more Source cves: CVE-2019-0199, CVE-2019-100...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.hyacinth.framework:core-service-admin-server (0.5.0) +1982 more potentially affected by CVE-2019-0199 +1 more via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =greenwich.sr1, =greenwich.sr1, =greenwich.sr1, =0.9.6, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2019-0199, CVE-2019-10072 Source advisory: GHSA-Q4HG-RMQ2-52Q9...

ai.aitia:arrowhead-application-library-java-spring (>=4.4.0.0, <=4.4.0.1), ai.hyacinth.framework:core-service-admin-server (0.5.0) +1982 more potentially affected by CVE-2019-10072 via org.apache.tomcat.embed:tomcat-embed-core (>=9.0.0.m1, <=9.0.19)

org.apache.tomcat.embed:tomcat-embed-core MAVEN version =9.0.0.m1, =4.4.0.0, =greenwich.sr1, =greenwich.sr1, =greenwich.sr1, =0.9.6, =0.0.1, =0.0.1, =0.0.1, =0.0.2 and more Source cves: CVE-2019-10072 Source advisory: OSV:GHSA-Q4HG-RMQ2-52Q9...