WordPress plugin Advanced Recent Posts 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site scripting vulnerability exists in WordPress...

PT-2023-16089 · WordPress · Advanced Recent Posts

Name of the Vulnerable Software and Affected Versions: Advanced Recent Posts WordPress plugin versions 0.6.14 and earlier Description: The issue arises from the plugin not validating and escaping some of its shortcode attributes before outputting them back in a page or post where the shortcode is...

CVE-2021-36393

In Moodle, an SQL injection risk was identified in the library fetching a user's recent courses...

CVE-2021-36393

CVE-2021-36393: Moodle SQL injection in recent courses library is supported by multiple connected documents detailing an authenticated, blind SQL injection via the sort parameter in Moodle’s course timeline feature. Exploits target Moodle 3.10.x (notably 3.10.1) and earlier, leveraging the core_c...

CVE-2023-26481 Insufficient user check in FlowTokens by Email stage

authentik is an open-source Identity Provider. Due to an insufficient access check, a recovery flow link that is created by an admin or sent via email by an admin can be used to set the password for any arbitrary user. This attack is only possible if a recovery flow exists, which has both an...

WordPress Advanced Recent Posts Plugin <= 0.6.14 is vulnerable to Cross Site Scripting (XSS)

Software Advanced Recent Posts Type Plugin Vulnerable versions = 0.6.14 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-0212 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 40ae855e2918 Credits Lana Codes...

Magecart Attack Disguised as Google Tag Manager

Magecart skimmers constantly evolve. Recent attacks aimed at stealing sensitive customer information illustrate the need for comprehensive security solutions...

SUSE CVE-2014-4348

Multiple cross-site scripting XSS vulnerabilities in phpMyAdmin 4.2.x before 4.2.4 allow remote authenticated users to inject arbitrary web script or HTML via a crafted 1 database name or 2 table name that is improperly handled after presence in a the favorite list or b recent tables...

Advanced Recent Posts <= 0.6.14 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. lptwrecentposts colorscheme='"...

CVE-2019-25093

A vulnerability, which was classified as problematic, was found in dragonexpert Recent Threads on Index. Affected is the function recentthreadlistthreads of the file inc/plugins/recentthreads/hooks.php of the component Setting Handler. The manipulation of the argument recentthreadforumskip leads ...

CVE-2019-25093 dragonexpert Recent Threads on Index Setting hooks.php recentthread_list_threads cross site scripting

A vulnerability, which was classified as problematic, was found in dragonexpert Recent Threads on Index. Affected is the function recentthreadlistthreads of the file inc/plugins/recentthreads/hooks.php of the component Setting Handler. The manipulation of the argument recentthreadforumskip leads ...

CVE-2019-25093 dragonexpert Recent Threads on Index Setting hooks.php recentthread_list_threads cross site scripting

A vulnerability, which was classified as problematic, was found in dragonexpert Recent Threads on Index. Affected is the function recentthreadlistthreads of the file inc/plugins/recentthreads/hooks.php of the component Setting Handler. The manipulation of the argument recentthreadforumskip leads ...

CVE-2019-25093

The CVE-2019-25093 entry describes a cross-site scripting vulnerability in dragonexpert’s Recent Threads on Index component. Affected is the function recentthread_list_threads in inc/plugins/recentthreads/hooks.php, where manipulating the argument recentthread_forumskip enables XSS. The issue rep...

PT-2023-11351 · Unknown · Dragonexpert

Name of the Vulnerable Software and Affected Versions: dragonexpert Recent Threads on Index affected versions not specified Description: A problematic vulnerability was found in the function recentthread list threads of the file inc/plugins/recentthreads/hooks.php of the component Setting Handler...

Recent Threads On Index 跨站脚本漏洞

Recent Threads On Index is a library for dragonexpert individual developers. Add sections to the index page for recent threads. A cross-site scripting vulnerability exists in Recent Threads On Index, which stems from cross-site scripting due to incorrect manipulation of the parameter...

[SECURITY] Fedora 37 Update: xfce4-places-plugin-1.8.3-1.fc37

A menu with quick access to folders, documents, and removable media. The Places plugin brings much of the functionality of GNOME=EF=BF=BD=EF=BF=BD=EF =BF=BDs Places menu to Xfce. It puts a simple button on the panel. Clicking on this button opens up a menu with 4 sections: 1 System-defined...

Wipermania: An All You Can Wipe Buffet

Wipermania: An All You Can Wipe Buffet By Trellix · November 15, 2022 This blog was written by Max Kersten In early 2022, Ukrainian companies were struck by multiple destructive wipers, attacking various organizations across sectors. This raised questions about the usage and impact of “digital...

Missing ReEntrancy Guard to Withdraw function

Lines of code Vulnerability details Impact Missing ReEntrancy Guard to Withdraw function Proof of Concept There is no re-entry risk on true ERC-20 tokens that work according to the spec i.e. audited, etc.. However you can write a malicious ERC-20 with custom transferFrom or approve that have...

CVE-2022-34713

creationtimestamp| type| source ---|---|--- 2022-08-09 23:04:14+00:00| exploited| https://t.me/ctinow/57216 2022-08-10 00:30:56+00:00| seen| https://t.me/cibsecurity/47814 2022-08-10 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=850 2022-08-10 12:05:04+00:00| seen|...

Gootkit Loader’s Updated Tactics and Fileless Delivery of Cobalt Strike

Gootkit has been known to use fileless techniques to drop Cobalt Strike and other malicious payloads. Insights from a recent attack reveal updates in its tactics...