CVE-2021-29447-PoC

CVE-2021-29447-PoC 概述 CVE-2021-29447 是一个 XML 外部实体（XXE）注入漏洞，影响运行在 PHP 8.0+ 环境下的 WordPress 版本 5.6–5.7（已在 5.7.1 中修复）。该漏洞存在于用于媒体元数据解析的 getID3 库中。 WordPress 通过 getID3 处理 WAV 文件的 iXML 块，该库使用 LIBXMLNOENT 标志调用 simplexmlloadstring。该标志显式启用了外部实体替换，从而绕过了 PHP 8 默认的 XXE 保护（已弃用的 libxmldisableentityloader）。 1...

CVE-2021-29447

WordPress XXE Vulnerability : CVE-2021-29447 A user with the ability to upload a malicious WAVE file like an Author can exploit an XML parsing issue in the Media Library in WordPress leading to XXE attacks and that could lead to file system disclosure Vulnerable code XML External Entity XXE...

Exploit for Improper Restriction of XML External Entity Reference in Wordpress

CVE-2021-29447-PoC Overview CVE-2021-29447 is an XML Exte...

EUVD-2021-2270

Malware in sbrugna...

EUVD-2007-1032

Malware in sbrugna...

VulnCheck KEV: CVE-2014-4535

Cross-site scripting XSS vulnerability in the Import Legacy Media plugin 0.1 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the filename parameter to getid3/demos/demo.mimeonly.php...

GHSA-5V43-55M5-QR8F getID3 is vulnerable to XML External Entity (XXE)

getID3 before 1.9.9, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

getID3 is vulnerable to XML External Entity (XXE)

getID3 before 1.9.9, as used in ownCloud Server before 5.0.15 and 6.0.x before 6.0.2, allows remote attackers to read arbitrary files, cause a denial of service, or possibly have other impact via an XML External Entity XXE attack...

GHSA-X2GW-85W6-FJJW Cross-site scripting in demos/demo.mysqli.php in getID3

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

Cross-site scripting in demos/demo.mysqli.php in getID3

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

DEBIAN-CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

UBUNTU-CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...

CVE-2021-40926

CVE-2021-40926 is an XSS vulnerability in the GetID3 project. Affects demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta, where the showtagfiles parameter may be abused to inject arbitrary script/HTML. Descriptions across multiple registries (NVD, OSV, GHSA, UBUNTU, Nessus) confirm the issue but...

CVE-2021-40926

Cross-site scripting XSS vulnerability in demos/demo.mysqli.php in getID3 1.X and v2.0.0-beta allows remote attackers to inject arbitrary web script or HTML via the showtagfiles parameter...