CVE-2023-22724

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22724 glpi contains XSS in RSS Description Link

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22724

GLPI is affected by CVE-2023-22724: versions prior to 10.0.6 are vulnerable to Cross-site Scripting via malicious RSS feeds imported by an administrator. Visiting RSS content with a crafted link can execute JavaScript in a user’s browser. The flaw is mitigated by upgrading to 10.0.6 or newer, per...

CVE-2023-22724 glpi contains XSS in RSS Description Link

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22724 glpi contains XSS in RSS Description Link

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

CVE-2023-22724: Improper Neutralization of Input During Web Page Generation

GLPI is a Free Asset and IT Management Software package. Versions prior to 10.0.6 are subject to Cross-site Scripting via malicious RSS feeds. An Administrator can import a malicious RSS feed that contains Cross Site Scripting XSS payloads inside RSS links. Victims who wish to visit an RSS conten...

WordPress Category Specific RSS feed Subscription Plugin <= v2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Category Specific RSS feed Subscription Type Plugin Vulnerable versions = v2.1 Fixed in v2.2 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-22691 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID aed3a951c25f Credi...

PT-2023-33349 · Linux · Linux Kernel

Name of the Vulnerable Software and Affected Versions: Linux Kernel versions prior to v5.4.227 Description: The issue is related to an out of bounds read in the mvneta config rss function. The actual impact and attack plausibility have not yet been proven. Recommendations: For Linux Kernel versio...

CVE-2023-22493

RSSHub (Node.js) is affected by a Server-Side Request Forgery (SSRF) vulnerability caused by unsafe route parameter handling. An attacker can induce the server to issue arbitrary HTTP requests, potentially accessing internal resources. The issue is mitigated by patch commit a66cbcf in RSSHub, and...

PT-2023-18544 · Rsshub · Rsshub

Name of the Vulnerable Software and Affected Versions: RSSHub affected versions not specified Description: RSSHub is an open source RSS feed generator that is vulnerable to Server-Side Request Forgery SSRF attacks. This issue allows an attacker to send arbitrary HTTP requests from the server to...

TTRSS-Auth-LDAP 注入漏洞

TTRSS-Auth-LDAP is a GitHub repository for the authldap plugin for Tiny Tiny RSS from the individual developer Ben Tyger. An injection vulnerability exists in TTRSS-Auth-LDAP. An attacker could exploit this vulnerability to cause LDAP injection...

RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. 1. Add the Feedzy RS...

WordPress RSS Feed Retriever Plugin <= 1.6.7 is vulnerable to Cross Site Request Forgery (CSRF)

Software RSS Feed Retriever Type Plugin Vulnerable versions = 1.6.7 Fixed in 1.6.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE N/A Patch priority Low CVSS severity Low 3.1 Developer Claim ownership PSID de28d2cfcddb Credits N/A Required privilege...

WordPress RSS Feed Retriever Plugin <= 1.6.7 is vulnerable to Broken Access Control

Software RSS Feed Retriever Type Plugin Vulnerable versions = 1.6.7 Fixed in 1.6.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE N/A Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID 7b026c8a46c6 Credits N/A Required privilege...

WordPress RSS Aggregator by Feedzy Plugin < 4.1.1 is vulnerable to Cross Site Scripting (XSS)

Software RSS Aggregator by Feedzy Type Plugin Vulnerable versions 4.1.1 Fixed in 4.1.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2022-4667 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID cee226bbb884 Credits István Márt...

RSS Aggregator by Feedzy < 4.1.1 - Contributor+ Stored XSS

The plugin does not validate and escape some of its block options before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. PoC 1. Add the Feedz...

Cross-RSS Plugin for WordPress Arbitrary Files Read

The WordPress Cross-RSS Plugin installed on the remote host is affected by an Arbitrary Files Read. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

CVE-2022-4358

The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-4359

The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-4360

The WP RSS By Publishers WordPress plugin through 0.1 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...