CVE-2022-3992

CVE-2022-3992 WonderCMS 中的跨站脚本 描述：Sanitization Management System v1.0 存在一个跨站脚本（XSS）漏洞，潜在攻击者可通过精心构造的名称将任意文件上传到系统信息字段（System Info Fields）中的系统徽标字段。该 Cookie 未设置 HttpOnly 标志，可能被用来窃取已登录用户的 Cookie。 如何复现：...

CVE-2026-59231 Server-Side Request Forgery in Pentestify PDF export via unvalidated image URLs

Server-Side Request Forgery in the PDF export component in maalfer Pentestify before 1.1.0 allows authenticated users to cause outbound HTTP GET requests from the server to arbitrary attacker-chosen destinations via unvalidated URLs stored in the finding images field or the report clientlogo fiel...

CVE-2021-24315

The GiveWP – Donation Plugin and Fundraising Platform WordPress plugin before 2.10.4 did not sanitise or escape the Background Image field of its Stripe Checkout Setting and Logo field in its Email settings, leading to authenticated admin+ Stored XSS issues...

PT-2021-15852 · Givewp · Givewp

Name of the Vulnerable Software and Affected Versions: GiveWP – Donation Plugin and Fundraising Platform versions prior to 2.10.4 Description: The issue is related to authenticated Stored XSS, where the Background Image field of the Stripe Checkout Setting and the Logo field in the Email settings...