Server side request forgery (ssrf)

A vulnerability classified as critical was found in DedeCMS 5.7.109. Affected by this vulnerability is an unknown functionality of the file codo.php. The manipulation of the argument rssurl leads to server-side request forgery. The exploit has been disclosed to the public and may be used. The...

PT-2023-25307 · Dedecms · Dedecms

Name of the Vulnerable Software and Affected Versions: DedeCMS version 5.7.109 Description: A critical issue was found in DedeCMS, affecting an unknown functionality of the file co do.php. The manipulation of the rssurl argument leads to server-side request forgery. Recommendations: For DedeCMS...

WordPress WP RSS Images Plugin <= 1.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software WP RSS Images Type Plugin Vulnerable versions = 1.1 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-36693 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b8ffa72740fa Credits LEE SE HYOUNG...

The vulnerability of the GLPI system’s request and incident handling process, related to the possibility of forging requests on the server side, allows attackers to perform SSRF attacks.

The vulnerability of the GLPI system’s request and incident handling functionality lies in insufficient verification of data entered by users in the automatic RSS detection function. Users can send specially crafted HTTP requests to trick the application into initiating requests to arbitrary...

CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

DEBIAN-CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

Cross site scripting

DokuWiki before 2023-04-04a allows XSS via RSS titles...

UBUNTU-CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

CVE-2023-34408

CVE-2023-34408 affects DokuWiki prior to the 2023-04-04a release. The issue is an XSS in RSS titles (root cause: improper handling of RSS titles) that can impact users who view crafted RSS feeds. CVSSv3.1 base score 5.4 (Medium): Network attack vector, low attack complexity, privileges required: ...

PT-2023-24860 · Dokuwiki +1 · Dokuwiki +1

Name of the Vulnerable Software and Affected Versions: DokuWiki versions prior to 2023-04-04a Description: The issue allows for XSS via RSS titles. Recommendations: For versions prior to 2023-04-04a, update to a version released after 2023-04-04a to resolve the issue...

CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

CVE-2023-34408

DokuWiki before 2023-04-04a allows XSS via RSS titles...

Cross-site Scripting (XSS)

craftcms/cms is vulnerable to Cross-site Scripting XSS. The vulnerability exists in the body.twig and links.twig due to the improper sanitization in the text attribute, which allows an attacker to inject and execute malicious javascript through the RSS feed...

CVE-2023-33195

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

Cross site scripting

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...

CVE-2023-33195 Craft CMS XSS in RSS widget feed

Craft is a CMS for creating custom digital experiences on the web. A malformed RSS feed can deliver an XSS payload. This issue was patched in version 4.4.6...