CVE-2025-23756

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in ivanchernyakov LawPress – Law Firm Website Management lawpress allows Reflected XSS.This issue affects LawPress – Law Firm Website Management: from n/a through = 1.4.5...

CVE-2024-54429

Cross-Site Request Forgery CSRF vulnerability in ivan-ovsyannikov Aphorismus aphorismus allows Stored XSS.This issue affects Aphorismus: from n/a through = 1.2.0...

whapa 安全漏洞

Whapa is a WhatsApp parser toolset by the individual developer Ivan Moreno. A security vulnerability exists in whapa version v1.59, which stems from vulnerability to a command injection attack via a carefully crafted filename for the HTML reporting component...

WordPress Poll Maker plugin <= 5.4.6 - Authenticated (Administrator+) SQL Injection vulnerability

Authenticated Administrator+ SQL Injection vulnerability discovered by Ivan Kuzymchak in WordPress Plugin Poll Maker versions = 5.4.6...

WordPress FluentForm plugin <= 5.1.19 - Authenticated (Form Manager+) Stored Cross-Site Scripting vulnerability

Authenticated Form Manager+ Stored Cross-Site Scripting vulnerability discovered by Ivan Kuzymchak in WordPress Plugin FluentForm versions = 5.1.19...

WordPress LuckyWP Table of Contents plugin <= 2.1.4 - Authenticated (Contributor+) Stored Cross-Site Scripting vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting vulnerability discovered by Ivan Kuzymchak in WordPress Plugin LuckyWP Table of Contents versions = 2.1.4...

WordPress WooCommerce Customers Manager Plugin < 29.7 is vulnerable to SQL Injection

Software WooCommerce Customers Manager Type Plugin Vulnerable versions 29.7 Fixed in 29.7 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0399 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 3c8fe0630d48 Credits Ivan Spiridonov Required privilege...

WordPress CodeisAwesome AIKit plugin <= 4.14.1 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Ivan Spiridonov Patchstack Alliance in WordPress Plugin AIKit versions = 4.14.1...

WordPress Fancy Product Designer Plugin < 6.1.5 is vulnerable to SQL Injection

Software Fancy Product Designer Type Plugin Vulnerable versions 6.1.5 Fixed in 6.1.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0365 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 8a2fcc7e3e05 Credits Ivan Spiridonov Required privilege...

[SECURITY] Fedora 40 Update: sdljava-0.9.1-62.fc40

sdljava is a Java binding to the SDL API being developed by Ivan Ganza. sdljava provides the ability to write games and other applications from the java programming language. sdljava is designed to be fast, efficient and easy to use...

Exploit for Cross-site Scripting in Alinto Sogo

CVE-2023-48104 HTML Injection in Alinto/SOGo Web Client Ve...

WordPress WPvivid Backup and Migration Plugin <= 0.9.89 is vulnerable to Cross Site Scripting (XSS)

Software WPvivid Backup and Migration Type Plugin Vulnerable versions = 0.9.89 Fixed in 0.9.90 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-5121 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID e1420d6f67a7 Credits Ivan...

WordPress FiboSearch – Ajax Search for WooCommerce Plugin <= 1.23.0 is vulnerable to Cross Site Scripting (XSS)

Software FiboSearch – Ajax Search for WooCommerce Type Plugin Vulnerable versions = 1.23.0 Fixed in 1.24.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-2450 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1e16f85faf8c Credi...

WordPress Quick Restaurant 2.0.2 XSS / CSRF / IDOR / Missing Authorization Vulnerabilities

On January 16, 2023, the Wordfence Threat Intelligence team responsibly disclosed several vulnerabilities in Quick Restaurant Menu, a WordPress plugin that allows users to set up restaurant menus on their sites. This plugin is vulnerable to missing authorization, insecure direct object reference,...

Learn from the T-Mobile API Breach to Improve Your API Security Program in 2023

A CISO’s job has never been more challenging. Engineering teams move fast, especially as organizations are accelerating their digital transformation efforts. The tech stack is exploding and varies greatly across the organization. And there is a surge of internal, external, and partner APIs. It’s...

contact_app 跨站脚本漏洞

contactapp is a contact application by the individual developer Ivan Stipić. A cross-site scripting vulnerability exists in contactapp, which stems from incorrect manipulation of the parameter var leading to cross-site scripting...

ivanmamuzic.com Cross Site Scripting vulnerability OBB-3064023

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

Cyber Security Framework: Back to Basics

Dr. Ivan Pavlov once said: “If you want new ideas, read old books.” The same applies with cybersecurity best practices. Discover how you can extend a basic cyber security framework to reduce systems and employee security risks...

ivanmeyertours.ch Cross Site Scripting vulnerability OBB-2826764

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

10 Years Journey into API Security Vulnerabilities with Ivan, the CEO of Wallarm

Ivan Novikov, CEO at Wallarm, is an API security expert, bug hunter, security researcher, and blackhat speaker with 24 years of experience in the cybersecurity field. He spent decades in this industry and witnessed exploits as well as growth. Read ahead to understand Ivan’s API Security journey a...