101 matches found
CVE-2024-0672 Pz-LinkCard <= 2.5.1 - Reflected XSS
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WordPress Plugin Pz-LinkCard 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in the...
CVE-2024-0672: Improper Neutralization of Input During Web Page Generation
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin...
WordPress Pz-LinkCard Plugin < 2.5.3 is vulnerable to Server Side Request Forgery (SSRF)
Software Pz-LinkCard Type Plugin Vulnerable versions 2.5.3 Fixed in 2.5.3 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-0677 Patch priority Low CVSS severity Low 4.9 Developer Claim ownership PSID f4404e8dcdac Credits Dmitrii Ignatyev Required privilege...
WordPress Plugin Pz-LinkCard 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
WordPress Plugin Pz-LinkCard 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2024-0673: Improper Neutralization of Input During Web Page Generation
The Pz-LinkCard WordPress plugin through 2.5.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2024-0677: Server-Side Request Forgery (SSRF)
The Pz-LinkCard WordPress plugin through 2.5.1 does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks...
WordPress Pz-LinkCard Plugin < 2.5.3 is vulnerable to Cross Site Scripting (XSS)
Software Pz-LinkCard Type Plugin Vulnerable versions 2.5.3 Fixed in 2.5.3 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-0673 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 043a2d038899 Credits Dmitrii Ignatyev Required...
PT-2024-15736 · WordPress · Pz-Linkcard
Name of the Vulnerable Software and Affected Versions: Pz-LinkCard WordPress plugin versions through 2.5.1 Description: The issue is related to a Reflected Cross-Site Scripting problem. It occurs because a parameter is not properly sanitised and escaped before being outputted back in the page. Th...
PT-2024-15737 · WordPress · Pz-Linkcard
Name of the Vulnerable Software and Affected Versions: Pz-LinkCard WordPress plugin versions 2.5.1 and earlier Description: The issue allows high privilege users, such as admins, to perform Cross-Site Scripting attacks, even when unfiltered html is disallowed, due to the plugin not sanitizing and...
PT-2024-15741 · WordPress · Pz-Linkcard
Name of the Vulnerable Software and Affected Versions: Pz-LinkCard WordPress plugin versions 2.5.1 and earlier Description: The issue allows high privilege users, such as contributors, to perform Server-Side Request Forgery SSRF attacks by pinging arbitrary hosts via some of the plugin's...
Pz-LinkCard < 2.5.3 - Reflected XSS
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open a page containing the code below ' /...
Pz-LinkCard < 2.5.3 - Contributor+ SSRF
Description The plugin does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks. Setup a listener on a localhost/LAN host such as nc -l 127.0.0.1 9000, then as a contributor, put the followi...
Pz-LinkCard < 2.5.3 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed Put the following payload in the "Class ID to be Added for PC" setting of the plugin...
Pz-LinkCard < 2.5.3 - Reflected XSS
Description The plugin does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin PoC Make a logged in admin open a page containing the code below...
Pz-LinkCard < 2.5.3 - Admin+ Stored XSS
Description The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed PoC Put the following payload in the "Class ID to be Added for PC" setting of the plugin...
Pz-LinkCard < 2.5.3 - Contributor+ SSRF
Description The plugin does not prevent users from pinging arbitrary hosts via some of its shortcodes, which could allow high privilege users such as contributors to perform SSRF attacks. PoC Setup a listener on a localhost/LAN host such as nc -l 127.0.0.1 9000, then as a contributor, put the...
