7678 matches found
Sql injection
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands...
CVE-2021-24137
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands...
Cross site scripting
Unvalidated input and lack of output encoding in the Themify Portfolio Post WordPress plugin, versions before 1.1.6, lead to Stored Cross-Site Scripting XSS vulnerabilities allowing low-privileged users Contributor+ to inject arbitrary JavaScript code or HTML in posts where the Themify Custom Pan...
CVE-2021-24137
CVE-2021-24137 affects the WordPress Blog2Social plugin prior to 6.3.1. Unvalidated input in the Re-Share Posts feature allows authenticated users to perform SQL injection, enabling arbitrary SQL execution against the database. The vulnerability is exploitable via the plugin’s Re-Share Posts flow...
CVE-2021-24137: Improper Neutralization of Special Elements used in an SQL Command
Unvalidated input in the Blog2Social WordPress plugin, versions before 6.3.1, lead to SQL Injection in the Re-Share Posts feature, allowing authenticated users to inject arbitrary SQL commands...
CVE-2021-24134: Improper Neutralization of Input During Web Page Generation
Unvalidated input and lack of output encoding in the Constant Contact Forms WordPress plugin, versions before 1.8.8, lead to multiple Stored Cross-Site Scripting vulnerabilities, which allowed high-privileged user Editor+ to inject arbitrary JavaScript code or HTML in posts where the malicious fo...
WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts
By default, the plugin allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages. A subscriber, upon registering an account with a site with the WP Pagebuilder plugin, could immediately modify or delete...
WP Page Builder < 1.2.4 - Insecure default configuration Allows Subscribers Editing Access to Posts
By default, the plugin allows subscriber-level users to edit and make changes to any and all posts pages - user roles must be specifically blocked from editing posts and pages. A subscriber, upon registering an account with a site with the WP Pagebuilder plugin, could immediately modify or delete...
Far-Right Platform Gab Has Been Hacked—Including Private Data
The transparency group DDoSecrets says it will make the 70 GB of passwords, private posts, and more available to researchers, journalists, and social scientists...
Process Steps Template Designer < 1.3 - CSRF to Stored Cross-Site Scripting (XSS)
The plugin did not properly check its CSRF nonce in the FontAwesomeField.save method, which could allow attackers to make logged in users capable of editing posts change the Step Icon of arbitrary Process Steps. Due to the lack of sanitisation of the submitted Step icon value, it could also lead ...
Working Together with Our Customers to Build a Sustainable Future
By now, we hope you've read Monday's and Tuesday's blog posts announcing the release of our annual sustainability report, our sustainability program, and the technical innovation behind it...
An Absurdly Basic Bug Let Anyone Grab All of Parler's Data
The “free speech” social network also allowed unlimited access to every public post, image, and video...
IPS Community Suite Cross-Site Scripting Vulnerability
IPS Community Suite is an Internet community software produced mainly by Invision Power Services, which is written in PHP and uses MySQL as a database management system. Versions of IPS Community Suite prior to 4.5.4.2 are vulnerable to a cross-site scripting vulnerability during a quoted post or...
CVE-2021-3026
Invision Community IPS Community Suite before 4.5.4.2 allows XSS during the quoting of a post or comment...
Invision Community 跨站脚本漏洞
IPS Community Suite is an Internet community software produced mainly by Invision Power Services, which is written in PHP and uses MySQL as a database management system. Versions of IPS Community Suite prior to 4.5.4.2 are vulnerable to a cross-site scripting vulnerability during a quoted post or...
Likely lead generation scam targets potential Malwarebytes MSP partners
Recently, Malwarebytes discovered a potential lead generation scam targeting companies that are interested in our Malwarebtyes Managed Service Provider MSP Program. In the scam, an individual who used the name “Jenny” aggressively contacted potential MSP partners claiming to represent Malwarebyte...
Nextcloud Social app access control error vulnerability
Nextcloud Nextcloud Social app is a social application from Nextcloud Germany. An access control error vulnerability exists in version 0.3.1 of the Nextcloud Social app. The vulnerability is related to the control system of the affected version not properly handling user access requests. There is...
CVE-2020-8278
Improper access control in Nextcloud Social app version 0.3.1 allowed to read posts of any user...