PT-2023-30820 · WordPress · Mappress Maps

Name of the Vulnerable Software and Affected Versions: MapPress Maps for WordPress versions up to, and including, 2.88.4 Description: The issue is related to Stored Cross-Site Scripting via the mappress shortcode due to insufficient input sanitization and output escaping on user-supplied...

PT-2023-30993 · Intergeo · Googlemaps Plugin

Name of the Vulnerable Software and Affected Versions: The Google Maps Plugin by Intergeo for WordPress versions up to, and including, 2.3.2 Description: The issue is related to Stored Cross-Site Scripting via the intergeo shortcode due to insufficient input sanitization and output escaping on...

WordPress Meks Easy Maps Plugin <= 2.1.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software Meks Easy Maps Type Plugin Vulnerable versions = 2.1.3 Fixed in 2.1.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-25989 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID e349a998361e Credits Muhammad Daffa...

Locatoraid Store Locator < 3.9.24 - Reflected XSS

Description The plugin does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. Setup as admin: - Locatoraid Configuration Google Maps Enter "none" at...

Locatoraid Store Locator < 3.9.24 - Reflected XSS

Description The plugin does not sanitise and escape the lpr-search parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin. PoC Setup as admin: - Locatoraid Configuration Google Maps Enter "none" a...

MAL-2023-1027 Malicious code in @ozon-maps/map-sdk (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware dbfd1be2f4f9a09e5f0ba2fbef81062825b5959a48a8e035d3bc1a1aeb527421 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Mapsdumper - Dump Place Details From Google Maps Like Phone, Email, Website, And Reviews

MAPSDUMPER Demo • Installation • Feature • Credits A tool for dumping place details from Google Maps such as phone numbers, emails, websites, and reviews. Demo Run / Installation How to run ? node index.js" dir="auto" git clone https://github.com/tegal1337/mapsdumper cd mapsdumper npm install nod...

WordPress Google Maps Plugin by Intergeo Plugin <= 1.1.5 is vulnerable to Cross Site Scripting (XSS)

Software Google Maps Plugin by Intergeo Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 6c46fd667005 Credits Rafie Muhammad...

WordPress WP Google Street View (with 360° virtual tour) & Google maps + Local SEO Plugin < 1.1.1 is vulnerable to Cross Site Scripting (XSS)

Software WP Google Street View with 360° virtual tour & Google maps + Local SEO Type Plugin Vulnerable versions 1.1.1 Fixed in 1.1.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

WordPress Mapster WP Maps Plugin < 1.2.36 is vulnerable to Cross Site Scripting (XSS)

Software Mapster WP Maps Type Plugin Vulnerable versions 1.2.36 Fixed in 1.2.36 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 42d3f06779ba Credits Rafie Muhammad Patchstack Requir...

WordPress Interactive Geo Maps Plugin < 1.6.1 is vulnerable to Cross Site Scripting (XSS)

Software Interactive Geo Maps Type Plugin Vulnerable versions 1.6.1 Fixed in 1.6.1 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 9b4f22117bce Credits Rafie Muhammad Patchstack...

Super Store Finder SQL注入漏洞

Super Store Finder is an easy to use Google Maps API store finder program Super Store Finder by Super Store Finder. A SQL injection vulnerability exists in Super Store Finder version 3.6, which stems from an incorrect manipulation of the parameter products that can lead to sql injection...

CVE-2023-29452 Remove possibility to add html into Geomap attribution field

Currently, geomap configuration Administration - General - Geographical maps allows using HTML in the field “Attribution text” when selected “Other” Tile provider...

Envoy 资源管理错误漏洞

Envoy is an open source distributed proxy server. A resource management error vulnerability exists in Envoy versions prior to 1.27.0, which stems from the possibility that Envoy's HTTP/2 codec may leak header maps and bookkeeping structures after receiving the frame RSTSTREAM from an upstream...

CVE-2023-37299

Joplin before 2.11.5 allows XSS via an AREA element of an image map...

PT-2023-4625 · Joplin · Joplin

Name of the Vulnerable Software and Affected Versions: Joplin versions prior to 2.11.5 Description: The issue is related to an AREA element of an image map, which allows for a cross-site scripting XSS attack. This can be exploited by a remote attacker to conduct an XSS attack. The vulnerability i...

xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow

A flaw was found in the xstream package. This flaw allows an attacker to cause a denial of service by injecting recursive collections or maps, raising a stack overflow...

xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow

A flaw was found in the xstream package. This flaw allows an attacker to cause a denial of service by injecting recursive collections or maps, raising a stack overflow...

xstream: Denial of Service by injecting recursive collections or maps based on element's hash values raising a stack overflow

A flaw was found in the xstream package. This flaw allows an attacker to cause a denial of service by injecting recursive collections or maps, raising a stack overflow...

WordPress Google Maps 9.0.17 Backup Disclosure

==================================================================================================================================== | Title : WordPress - Google maps 9.0.17 Backup Disclosure Vulnerability | | Author : indoushka | | Tested on : windows 10 Français V.Pro / browser : Mozilla firefo...