WPeMatico RSS Feed Fetcher < 2.6.12 - Admin+ Stored Cross-Site Scripting

The plugin does not escape the Feed URL added to a campaign before outputting it in an attribute, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Create/edit a campaign and add the following feed URL:...

CVE-2021-24511

The fetchproductajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

CVE-2021-24511

The fetchproductajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

Sql injection

The fetchproductajax functionality in the Product Feed on WooCommerce WordPress plugin before 3.3.1.0 uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection...

WordPress Easy Twitter Feed plugin <= 1.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Michał Lipiński in WordPress Easy Twitter Feed plugin versions = 1.1. Solution Update the WordPress Easy Twitter Feed plugin to the latest available version at least 1.2...

Easy Twitter Feed < 1.2 - Contributor+ Stored Cross-Site Scripting

The plugin does not sanitise or validate the parameters from its shortcode, allowing users with a role as low as contributor to set Cross-Site Scripting payload in them which will be triggered in the page/s with the embed malicious shortcode PoC Log in as contributor and add the following shortco...

CVE-2021-38163

creationtimestamp| type| source ---|---|--- 2021-09-14 16:21:47+00:00| seen| https://t.me/cibsecurity/28795 2021-09-15 14:22:34+00:00| seen| https://t.me/ptswarm/72 2021-09-16 15:55:40+00:00| seen| https://t.me/truesecator/2111 2023-06-14 21:10:04+00:00| seen|...

CVE-2021-30632

creationtimestamp| type| source ---|---|--- 2021-09-14 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=648 2021-09-14 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=647 2021-09-14 10:58:48+00:00| exploited| https://t.me/truesecator/2098 2021-09-14...

CVE-2021-24508

The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feedlocator AJAX action available to both authenticated and unauthenticated users before outputting a truncated version of it in the admin dashboard, leading to an...

CVE-2021-24508

The Smash Balloon Social Post Feed WordPress plugin before 2.19.2 does not sanitise or escape the feedID POST parameter in its feedlocator AJAX action available to both authenticated and unauthenticated users before outputting a truncated version of it in the admin dashboard, leading to an...

CVE-2021-24508

The issue CVE-2021-24508 concerns the Smash Balloon Social Post Feed WordPress plugin prior to version 2.19.2. The vulnerability arises because the feed_locator AJAX action does not sanitize or escape the POST parameter feedID, and the truncated value is output in the admin dashboard. This leads ...

WordPress 插件跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress plugin Smash Balloon Social Post Feed, which...

CVE-2020-19769

creationtimestamp| type| source ---|---|--- 2021-09-08 02:22:54+00:00| seen| https://t.me/cibsecurity/28410...

CVE-2021-37415

creationtimestamp| type| source ---|---|--- 2021-09-01 12:34:35+00:00| seen| https://t.me/cibsecurity/28145 2023-06-14 21:10:04+00:00| seen| MISP/3c19819c-1dac-4ef2-bfed-be5efa7e0123 2023-12-05 00:47:32+00:00| seen| https://t.me/arpsyndicate/1347 2024-12-24 20:25:26+00:00| seen|...

python: CRLF injection via HTTP request method in httplib/http.client

A flaw was found in Python. The built-in modules httplib and http.client included in Python 2 and Python 3, respectively do not properly validate CRLF sequences in the HTTP request method, potentially allowing manipulation to the request by injecting additional HTTP headers. The highest threat fr...

CVE-2021-32648

creationtimestamp| type| source ---|---|--- 2021-08-26 22:27:39+00:00| seen| https://t.me/cibsecurity/27916 2022-01-14 12:46:35+00:00| exploited| https://t.me/RussianOSINT/1142 2022-01-16 16:00:02+00:00| seen| https://t.me/secsocteam/227 2022-01-16 18:19:49+00:00| exploited|...

Create WooCommerce Product Feeds For 40+ Merchants < 3.3.1.0 - Authenticated SQL Injection

The fetchproductajax functionality in the plugin uses a productid POST parameter which is not properly sanitised, escaped or validated before inserting to a SQL statement, leading to SQL injection. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Length: 162 Accept: / X-Requested-With:...

[SECURITY] Fedora 34 Update: newsflash-1.4.1-2.fc34

A modern feed reader designed for the GNOME desktop. NewsFlash is a program designed to complement an already existing web-based RSS reader account. It combines all the advantages of web based services like syncing across all your devices with everything you expect from a modern desktop program:...

[SECURITY] Fedora 34 Update: newsboat-2.24-1.fc34

Newsboat is a fork of Newsbeuter, an RSS/Atom feed reader for the text consol e...

WordPress Easy Social Feed plugin <= 6.2.6 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by WPScanTeam in WordPress Easy Social Feed plugin versions = 6.2.6. Solution Update the WordPress Easy Social Feed plugin to the latest available version at least 6.2.7...