CVE-2020-36413

A stored cross scripting XSS vulnerability in CMS Made Simple 2.2.14 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload entered into the "Exclude these IP addresses from the "Site Down" status" parameter under the "Maintenance Mode" module...

CMS Made Simple 跨站脚本漏洞

CMS Made Simple CMSMS is an open source content management system that provides developers, programmers, and website owners with a web-based version of the development and management interface. A stored cross-site scripting vulnerability exists in CMS Made Simple version 2.2.14, which can be...

CVE-2021-24191

Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blo...

CVE-2021-24191

Low privileged users can use the AJAX action 'cppluginsdobuttonjoblatercallback' in the WP Maintenance Mode & Site Under Construction WordPress plugin before 1.8.2, to install any plugin including a specific version from the WordPress repository, as well as activate arbitrary plugin from then blo...

CVE-2021-24191

The CVE-2021-24191 entry concerns the WordPress WP Maintenance Mode & Site Under Construction plugin (versions before 1.8.2). A low-privilege user can abuse the AJAX action cp_plugins_do_button_job_later_callback to install any plugin (including a specific version) from the WordPress repository a...

WordPress plugin WP Maintenance Mode & Site Under Construction 安全漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . WP Maintenance Mode & Site Under Construction An...

WordPress plugin WP Maintenance Mode & Site Under Construction 安全漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress Plugin is a WordPress open source application plugin . An authorization issue vulnerability exists in versions o...

WordPress WP Maintenance Mode & Site Under Construction plugin <= 1.8.1 - Arbitrary Plugin Installation and Activation vulnerability

Arbitrary Plugin Installation and Activation vulnerability discovered by Bugbang in WordPress WP Maintenance Mode & Site Under Construction plugin versions = 1.8.1. Solution Update the WordPress WP Maintenance Mode & Site Under Construction plugin to the latest available version at least 1.8.2...

Under Construction, Coming Soon & Maintenance Mode < 1.1.2 - Server Side Request Forgery (SSRF)

The includes/mc-getlists.php file used the 'apiKey' POST parameter to create an https URL from it without sanitisation and called it with cURL, leading to a SSRF issue. The issue is exploitable via direct access to the affected file, and ucmmmcapi AJAX call available to both authenticated and...

Under Construction, Coming Soon & Maintenance Mode < 1.1.2 - Reflected Cross-Site Scripting (XSS)

The includes/mc-getlists.php file decoded JSON data fetched from the URL provided and then displayed the HTML from the response without any HTML escaping, leading to a reflected cross-site scripting issue where the payload is on a different server controlled by the attacker for example. The issue...

Under Construction, Coming Soon & Maintenance Mode < 1.1.2 - Reflected Cross-Site Scripting (XSS)

The includes/mc-getlists.php file decoded JSON data fetched from the URL provided and then displayed the HTML from the response without any HTML escaping, leading to a reflected cross-site scripting issue where the payload is on a different server controlled by the attacker for example. The issue...

Under Construction, Coming Soon & Maintenance Mode < 1.1.2 - Server Side Request Forgery (SSRF)

The includes/mc-getlists.php file used the 'apiKey' POST parameter to create an https URL from it without sanitisation and called it with cURL, leading to a SSRF issue. The issue is exploitable via direct access to the affected file, and ucmmmcapi AJAX call available to both authenticated and...

WordPress Under Construction, Coming Soon & Maintenance Mode plugin <= 1.1.1 - Server-Side Request Forgery (SSRF) vulnerability

Server-Side Request Forgery SSRF vulnerability found by Mr.F in WordPress Under Construction, Coming Soon & Maintenance Mode plugin versions = 1.1.1. Solution Update the WordPress Under Construction, Coming Soon & Maintenance Mode plugin to the latest available version at least 1.1.2...

WordPress Under Construction, Coming Soon & Maintenance Mode plugin <= 1.1.1 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Mr.F in WordPress Under Construction, Coming Soon & Maintenance Mode plugin versions = 1.1.1. Solution Update the WordPress Under Construction, Coming Soon & Maintenance Mode plugin to the latest available version at least 1.1.2...

Information disclosure

When in maintenance mode, Magento version 2.4.0 and 2.3.4 and earlier are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable...

Citrix App Layering 2.x: Unidesk Appliance Move Utility

Introduction Moving a Unidesk Cachepoint CP from one datastore to another using standard VMware tools is problematic because the layers created by the CP are non-persistent independent disks. If these are moved with a storage vMotion, they will be transformed into normal disks attached to the CP...

CVE-2020-24406

When in maintenance mode, Magento version 2.4.0 and 2.3.4 and earlier are affected by an information disclosure vulnerability that could expose the installation path during build deployments. This information could be helpful to attackers if they are able to identify other exploitable...

PT-2020-4581 · Adobe · Magento Commerce

Name of the Vulnerable Software and Affected Versions: Magento Commerce versions 2.3.4 and earlier Magento Commerce version 2.4.0 Description: The issue exists due to insufficient input validation, potentially allowing a remote attacker to access confidential information. In maintenance mode, an...

WordPress Coming Soon & Maintenance Mode Page plugin <= 1.57 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Jerome Bruandet NinTechNet in WordPress Coming Soon & Maintenance Mode Page plugin versions = 1.57. Solution Update the WordPress Coming Soon & Maintenance Mode Page plugin to the latest available version at least 1.58...

Palo Alto Networks PAN-OS 8.0.x / 8.1.x < 8.1.16 DoS

The version of Palo Alto Networks PAN-OS running on the remote host is 8.0.x or 8.1.x prior to 8.1.16. It is, therefore, affected by a denial of service DoS vulnerability. An insecure configuration of the appweb daemon allows a remote, unauthenticated user to send a specifically crafted request t...