Cross site scripting

The Search Forms page of the Ivory Search WordPress lugin before 4.6.1 did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to...

Ivory Search < 4.6.1 - Reflected Cross Site Scripting (XSS)

The Search Forms page of the plugin did not properly sanitise the tab parameter before output it in the page, leading to a reflected Cross-Site Scripting issue when opening a malicious crafted link as a high privilege user. Knowledge of a form id is required to conduct the attack. PoC...

CVE-2020-8436

XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rmformid, rmtr, or formname parameter...

CVE-2020-8436

XSS was discovered in the RegistrationMagic plugin 4.6.0.0 for WordPress via the rmformid, rmtr, or formname parameter...

CVE-2018-19287

XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php aka submissions page begindate, enddate, or formid parameter...

PT-2018-14905

Name of the Vulnerable Software and Affected Versions Ninja Forms plugin versions prior to 3.3.18 Description The issue allows remote attackers to execute JavaScript. This is achieved via the begin date, end date, or form id parameter in the submissions page, which is part of the...

CVE-2017-17055

Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting XSS attack involving the username-form-id parameter to freeradius.users.php...

CVE-2017-17055: Improper Neutralization of Special Elements used in an OS Command

Artica Web Proxy before 3.06.112911 allows remote attackers to execute arbitrary code as root by conducting a cross-site scripting XSS attack involving the username-form-id parameter to freeradius.users.php...

WordPress Contact Form plugin <= 2.7.5 - SQL Injection

No description provided by source. Exploit Title: WordPress Contact Form plugin = 2.7.5 SQL Injection Vulnerability Date: 2011-10-13 Author: Skraps jackie.craig.sparksatlive.com jackie.craig.sparksatgmail.com @skrapsfoo Software Link: http://downloads.wordpress.org/plugin/contact-form-wordpress.z...

Mambo Component n-form (form_id) Blind SQL Injection Exploit

Exploit for unknown platform in category web applications ============================================================ Mambo Component n-form formid Blind SQL Injection Exploit ============================================================ !/usr/bin/perl use LWP::UserAgent; use Getopt::Long;...