malefertilitydoc.com Cross Site Scripting vulnerability OBB-3208809

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

maison-des-cameras.com Cross Site Scripting vulnerability OBB-3208757

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

madapatimedicalandaesthetic.com Cross Site Scripting vulnerability OBB-3208676

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

liverspecialtycenter.com Cross Site Scripting vulnerability OBB-3208593

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress plugin CMP–Coming Soon & Maintenance 信息泄露漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. An information disclosure vulnerability...

Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access in Maintenance Mode

The plugin does not restrict access to published and non protected posts/pages when the maintenance mode is enabled, allowing unauthenticated users to access them PoC Run the below command in the developer console of the web browser while being on the blog as unauthenticated, when maintenance mod...

WordPress Postmatic Plugin < 2.2.10 is vulnerable to PHP Object Injection

Software Postmatic Type Plugin Vulnerable versions 2.2.10 Fixed in 2.2.10 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2022-4265 Patch priority High CVSS severity High 7.4 Developer Claim ownership PSID 96f8ea22622f Credits Lana Codes Required privilege Subscriber...

marimauro.com Cross Site Scripting vulnerability OBB-3207224

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Smart Slider 3 Plugin < 3.5.1.14 is vulnerable to Cross Site Scripting (XSS)

Software Smart Slider 3 Type Plugin Vulnerable versions 3.5.1.14 Fixed in 3.5.1.14 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0660 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 008134aaa2eb Credits Erwan LR WPScan...

WordPress HT Slider For Elementor Plugin < 1.4.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software HT Slider For Elementor Type Plugin Vulnerable versions 1.4.0 Fixed in 1.4.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-0495 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID fea57db2be31 Credits Lana Codes...

WordPress HT Portfolio Plugin <= 1.1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software HT Portfolio Type Plugin Vulnerable versions = 1.1.5 Fixed in 1.1.6 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-0497 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3421d1e706d1 Credits Lana Codes Required...

WordPress DecaLog Plugin <= 3.7.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software DecaLog Type Plugin Vulnerable versions = 3.7.0 Fixed in 3.7.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27444 Patch priority Low CVSS severity Low 4.3 Developer PerfOps One PSID 721ad967e10d Credits Mika Required privilege...

WordPress Jetpack CRM Plugin <= 5.4.4 is vulnerable to Cross Site Scripting (XSS)

Software Jetpack CRM Type Plugin Vulnerable versions = 5.4.4 Fixed in 5.5.0 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-27429 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID ddffc0e309f7 Credits Team WeBoB Required privile...

MAL-2023-3013 Malicious code in esqintpaypalram (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx 7e58c353f270d5bb210ec260b725d41fd70a2930183f6c488f0ca25ecfc412f4 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

MAL-2023-2819 Malicious code in esqcvcpupy (PyPI)

--- -= Per source details. Do not edit below this line.=- Source: checkmarx bcbac33ff9f7c73d0f497c686eaf5398fe8c8ef2922e95c6349c203938b65d45 EsqueleSquad group published nearly 6000 malicious PyPi and NPM packages, executing spyware and information-stealing malware...

WordPress Metform Elementor Contact Form Builder Plugin <= 3.2.1 is vulnerable to Bypass Vulnerability

Software Metform Elementor Contact Form Builder Type Plugin Vulnerable versions = 3.2.1 Fixed in 3.2.2 OWASP Top 10 A5: Broken Access Control Classification Bypass Vulnerability CVE CVE-2023-0085 Patch priority Low CVSS severity Low 5.3 Developer Wpmet PSID 9ebffbb7ebd5 Credits Mohammed El Amin...

WordPress Leyka Plugin <= 3.29.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Leyka Type Plugin Vulnerable versions = 3.29.2 Fixed in 3.30 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-27442 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID dc5061a06f06 Credits yuyudhn Required privilege...

WordPress FluentSMTP Plugin < 2.2.3 is vulnerable to Cross Site Scripting (XSS)

Software FluentSMTP Type Plugin Vulnerable versions 2.2.3 Fixed in 2.2.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0219 Patch priority Low CVSS severity Low 6.5 Developer WP ManageNinja LLC PSID 66b9f775cfeb Credits Vaibhav Rajput Required...

WordPress FareHarbor for WordPress Plugin <= 3.6.6 is vulnerable to Cross Site Scripting (XSS)

Software FareHarbor for WordPress Type Plugin Vulnerable versions = 3.6.6 Fixed in 3.6.7 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-25021 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 21ca10a896e3 Credits Rio Darmawan...

WordPress Synved Shortcodes Plugin <= 1.6.36 is vulnerable to Cross Site Scripting (XSS)

Software Synved Shortcodes Type Plugin Vulnerable versions = 1.6.36 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0063 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 97249fb0c45f Credits Lana Codes Requir...