34 matches found
CVE-2012-20003
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
CVE-2012-20003
The Custom Tables plugin for WordPress (versions before 3.4.6 ) is vulnerable to a reflected cross-site scripting (XSS) vulnerability. The root cause is the lack of sanitization on the 'key' parameter within the iframe.php component. An unauthenticated attacker can craft a GET request to /wp-cont...
EUVD-2012-6611
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
CVE-2012-20003 Custom Tables WordPress Plugin < 3.4.6 Reflected XSS via iframe.php
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
VulnCheck KEV: CVE-2012-20003
Custom Tables plugin for WordPress before 3.4.6 contains a reflected cross-site scripting vulnerability that allows unauthenticated attackers to inject scripts through the unsanitized 'key' parameter in iframe.php. Attackers can craft GET requests to /wp-content/plugins/custom-tables/iframe.php...
WordPress Embed Swagger <=1.0.0 - Cross-Site Scripting Detection
WordPress Embed Swagger plugin 1.0.0 and prior contains a reflected cross-site scripting vulnerability due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file, which allows attackers to inject arbitrary web scripts onto the page...
CVE-2026-43878: Improper Neutralization of Input During Web Page Generation
WWBN AVideo is an open source video platform. In versions up to and including 29.0, plugin/Meet/iframe.php echoes the attacker-controlled user and pass query parameters unescaped into a JavaScript double-quoted string literal inside a...
EUVD-2008-0863
Malware in sbrugna...
EUVD-2006-1203
Malware in sbrugna...
CVE-2022-1985
The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the /src/Package/views/shortcode-iframe.php file...
CVE-2022-1985: Improper Neutralization of Input During Web Page Generation
The Download Manager Plugin for WordPress is vulnerable to reflected Cross-Site Scripting in versions up to, and including 3.2.42. This is due to insufficient input sanitization and output escaping on the 'frameid' parameter found in the /src/Package/views/shortcode-iframe.php file...
CVE-2022-0381: Improper Neutralization of Input During Web Page Generation
The Embed Swagger WordPress plugin is vulnerable to Reflected Cross-Site Scripting due to insufficient escaping/sanitization and validation via the url parameter found in the /swagger-iframe.php file which allows attackers to inject arbitrary web scripts onto the page, in versions up to and...
PT-2022-13141
Name of the Vulnerable Software and Affected Versions Embed Swagger WordPress plugin version 1.0.0 and earlier Description The issue arises from insufficient escaping, sanitization, and validation of the url parameter in the /swagger-iframe.php file, allowing attackers to inject arbitrary web...
eichgossau.ch XSS vulnerability
Vulnerable URL: http://eichgossau.ch/static/iframe.php?id=31327=3132%27%22%3E%3Cimg%20src=x%20onerror=alert/OPENBUGBOUNTY/%3E7=0%20WHG.%20=10=.h10%20.%20.w=1 Details: Description| Value ---|--- Patched:| No Latest check for patch:| 04.01.2018 Vulnerability type:| XSS Vulnerability status:| Public...
adwords.smedia.ca XSS vulnerability
Vulnerable URL: http://adwords.smedia.ca/adwords-tracker-iframe.php?stocknumber===name=yorkdaleford=http://yorkdaleford.com/ford-fleet-toronto-commercial-vehicles" / Details: Description| Value ---|--- Patched:| No Latest check for patch:| 28.07.2017 Vulnerability type:| XSS Vulnerability status:...
meteocam.gr XSS vulnerability
Vulnerable URL: http://www.meteocam.gr/iframe.php?id=%22%3E%3Csvg/onload=prompt%28/OPENBUGBOUNTY/%29%3E Details: Description| Value ---|--- Patched:| No Latest check for patch:| 27.07.2017 Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank| Unknown / Not calculated VIP...
CVE-2015-4660
The CVE-2015-4660 entry concerns Enhanced SQL Portal 5.0.7961, a web-based MySQL administration tool. The vulnerability is an XSS in iframe.php, exploitable via the id parameter, allowing remote attackers to inject arbitrary script/HTML. The issue is documented across multiple sources, including ...
PT-2015-6660
Name of the Vulnerable Software and Affected Versions Enhanced SQL Portal version 5.0.7961 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the id parameter to "iframe.php" API endpoint. Recommendations For version 5.0.7961, avoid usi...
CVE-2015-4660: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in Enhanced SQL Portal 5.0.7961 allows remote attackers to inject arbitrary web script or HTML via the id parameter to iframe.php...
