CVE-2021-43032

CVE-2021-43032 XenForo ≤ 2.2.7 において、管理パネルにアクセスできる脅威アクターは、HTMLコードを受け付けるアプリケーション内の任意の機能にクロスサイトスクリプティングペイロードを保存できます。「広告」機能内に配置されたペイロードはクライアント側でグローバルに実行され、複数の悪用シナリオを可能にしますが、他のペイロードは保存された場所に応じてクライアント側で実行されます。 クレジット: John Jackson @johnjhacking & Jackson Henry @JacksonHHax 再現手順 1. /admin.php...

WordPress plugin MailerPress – Email Marketing, Newsletter, Email Automation & WooCommerce Emails 跨站脚本漏洞

WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. The...

Portábilis i-Educar 安全漏洞

Portábilis i-Educar is an application from Portábilis. It can easily help you with basic and technical education. A security vulnerability exists in Portábilis i-Educar, which stems from the fact that lack of cleanup of user-controlled parameters used to dynamically generate HTML field values can...

GHSA-JX34-GQQQ-R6GM Stored XSS via HTML fields in SilverStripe Framework

SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

Stored XSS via HTML fields in SilverStripe Framework

SilverStripe Framework through 4.10.8 allows XSS, inside of script tags that can can be added to website content via XHR by an authenticated CMS user if the cwp-core module is not installed on the sanitiseserverside contig is not set to true in project code...

CVE-2022-25238: Stored XSS via HTML fields

More info at https://www.silverstripe.org/download/security-releases/cve-2022-25238...

lpar2rrd 安全漏洞

Xorux LPAR2RRD is a server monitoring tool from the Czech company Xorux. A security vulnerability exists in lpar2rrd that stems from a password management error in XoruX LPAR2RRD and STOR2RRD prior to 7.30. An attacker could exploit this vulnerability to cause information disclosure due to the...

WordPress 4.0.1 Cross-Site Scripting Vulnerability Patch

WordPress’s latest update, 4.0.1, patches a critical cross-site scripting vulnerability affecting comment boxes on websites running the content management system software. An attacker would need only to inject malicious JavaScript into a comment that would infect a reader viewing it on the webpag...