CVE-2021-29447-PoC

CVE-2021-29447-PoC 概要 CVE-2021-29447 は、PHP 8.0+ で実行されている WordPress バージョン 5.6～5.7（5.7.1 でパッチ適用済み）に影響する XML External Entity XXE インジェクションの脆弱性です。この脆弱性は、メディアメタデータの解析に使用される getID3 ライブラリに存在します。 WordPress は getID3 を介して WAV ファイルの iXML チャンクを処理します。getID3 は LIBXMLNOENT フラグを指定して simplexmlloadstring...

CVE-2021-29447

WordPress XXE 취약점 : CVE-2021-29447 악의적인 WAVE 파일을 업로드할 수 있는 사용자예: 작성자는 WordPress 미디어 라이브러리의 XML 구문 분석 문제를 악용하여 XXE 공격을 유발하고 파일 시스템 노출로 이어질 수 있습니다. 취약한 코드 XML 외부 엔티티XXE 취약점 XML은 문서 전체에서 재사용할 수 있는 사용자 정의 엔티티를 정의할 수 있는 기능을 제공합니다. 예를 들어 중복을 피하기 위해 사용될 수 있습니다. 다음 코드는 추가 사용을 위해 myEntity 엔티티를 정의합니다. 정의된...

Exploit for Improper Restriction of XML External Entity Reference in Wordpress

CVE-2021-29447-PoC Overview CVE-2021-29447 is an XML Exte...

EUVD-2021-2270

Malware in sbrugna...

EUVD-2007-1032

Malware in sbrugna...

VulnCheck KEV: CVE-2014-4535

Cross-site scripting XSS vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php...

GHSA-5V43-55M5-QR8F getID3 is vulnerable to XML External Entity (XXE)

getID3 before 1.9.9, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

getID3 is vulnerable to XML External Entity (XXE)

getID3 before 1.9.9, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

GHSA-X2GW-85W6-FJJW Cross-site scripting in demos/demo.mysqli.php in getID3

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

Cross-site scripting in demos/demo.mysqli.php in getID3

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

DEBIAN-CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

UBUNTU-CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

CVE-2021-40926 is an XSS vulnerability in the GetID3 project. Affects demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta, where the showtagfiles parameter may be abused to inject arbitrary script/HTML. Descriptions across multiple registries (NVD, OSV, GHSA, UBUNTU, Nessus) confirm the issue but...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...