CVE-2022-37255

TP-Link Tapo C310 1.3.0 devices allow access to the RTSP video feed via credentials of User --- and Password TPL075526460603...

CVE-2023-29202

CVE-2023-29202 affects XWiki Commons and is caused by the RSS macro emitting feed item HTML without cleaning when content=true, enabling XSS (and potential privilege escalation/remote actions) under a user with programming rights. The vulnerability is addressed in XWiki 14.6 RC1, where feed conte...

XWiki Commons 跨站脚本漏洞

XWiki Commons is a technology library shared by several other top XWiki projects. A cross-site scripting vulnerability exists in XWiki Commons, which stems from the fact that when the parameter content is set to true, the RSS macro bundled with XWiki contains the content of feed items without any...

CVE-2023-2033

creationtimestamp| type| source ---|---|--- 2023-04-14 22:26:08+00:00| seen| https://t.me/cibsecurity/62179 2023-04-15 11:25:53+00:00| exploited| Telegram/QAczKYY1AjlKpyXyD7J422tVel4nX10bghdW00h3kJEqUmA 2023-04-15 16:33:23+00:00| exploited| https://t.me/crackcodes/3233 2023-04-16 11:14:57+00:00|...

CVE-2023-29492

creationtimestamp| type| source ---|---|--- 2023-04-14 11:15:26+00:00| seen| MISP/6a1e78c5-1baf-4ae6-8ad7-959df8a51015 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2024-12-24 20:34:12+00:00| seen| https://feedsin.space/feed/CISAKevBot/items/2971799 2025-02-23...

WordPress Product Catalog Feed by PixelYourSite Plugin < 2.1.1 is vulnerable to Cross Site Scripting (XSS)

Software Product Catalog Feed by PixelYourSite Type Plugin Vulnerable versions 2.1.1 Fixed in 2.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1805 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID e27f0a1e6a1c Credits...

CVE-2023-28206

creationtimestamp| type| source ---|---|--- 2023-04-10 09:02:28+00:00| exploited| https://t.me/itsecnews/2430 2023-04-10 12:29:34+00:00| exploited| https://t.me/truesecator/4268 2023-04-10 22:22:57+00:00| exploited| https://t.me/cibsecurity/61783 2023-04-11 07:53:32+00:00| seen|...

Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS

The plugin does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators. Make a logged in admin open the following URL:...

Product Catalog Feed by PixelYourSite < 2.1.1 - Reflected XSS

The plugin does not sanitise and escape the edit parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as administrators. PoC Make a logged in admin open the following URL:...

CVE-2022-46793

Cross-Site Request Forgery CSRF vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin = 12.4.4 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin = 12.4.4 versions...

CVE-2022-46793 WordPress Product Feed PRO for WooCommerce Plugin <= 12.4.4 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in AdTribes.Io Product Feed PRO for WooCommerce plugin = 12.4.4 versions...

CVE-2022-46793

CVE-2022-46793 describes a CSRF vulnerability in the WordPress plugin “Product Feed PRO for WooCommerce” by AdTribes.Io, affecting versions up to 12.4.4. The issue allows unauthenticated CSRF exploitation that can cause unintended actions such as updating plugin settings or projects. Patch inform...

PT-2023-15038 · Woocommerce · Adtribes.Io Product Feed Pro

Name of the Vulnerable Software and Affected Versions: AdTribes.Io Product Feed PRO for WooCommerce plugin versions = 12.4.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintend...

WordPress plugin Product Feed PRO for WooCommerce 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forger...

atrocore 1.5.25 User interaction - Unauthenticated File upload - RCE

Exploit Title: atrocore 1.5.25 User interaction - Unauthenticated File upload - RCE Author: nu11secur1ty Date: 02.16.2023 Vendor: https://atropim.com/ Software: https://github.com/atrocore/atrocore/releases/tag/1.5.25 Reference: https://portswigger.net/web-security/file-upload Description: The...

Server side request forgery (ssrf)

GLPI is a free asset and IT management software package. Starting in version 0.84 and prior to versions 9.5.13 and 10.0.7, usage of RSS feeds is subject to server-side request forgery SSRF. In case the remote address is not a valid RSS feed, an RSS autodiscovery feature is triggered. This feature...

PT-2023-3261 · Glpi +2 · Glpi +2

Name of the Vulnerable Software and Affected Versions: GLPI versions 0.84 through 9.5.12 GLPI versions 10.0.0 through 10.0.6 Description: The issue is related to the usage of RSS feeds in GLPI, which is subject to server-side request forgery SSRF. When the remote address is not a valid RSS feed, ...

CVE-2023-1671

creationtimestamp| type| source ---|---|--- 2023-04-04 14:36:57+00:00| seen| https://t.me/cibsecurity/61374 2023-04-05 15:15:02+00:00| seen| https://t.me/truesecator/4254 2023-04-24 04:35:31+00:00| published-proof-of-concept| https://t.me/CNArsenal/525 2023-04-25 09:47:32+00:00|...

WordPress Feed Them Social Plugin <= 4.0.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software Feed Them Social Type Plugin Vulnerable versions = 4.0.7 Fixed in 4.0.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 05631f832ac3 Credits Unknown Required privilege...