CVE-2020-4049

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...

CVE-2020-4049 Authenticated self-XSS via theme uploads in WordPress

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...

CVE-2020-4049: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS)

In affected versions of WordPress, when uploading themes, the name of the theme folder can be crafted in a way that could lead to JavaScript execution in /wp-admin on the themes page. This does require an admin to upload the theme, and is low severity self-XSS. This has been patched in version...

Imgur: self-xss with ClickJacking can leads to account takeover in Firefox

Description Hi, i think i found a valid chaining issues here ClickJacking issue I discovered that have some endpoints that permits to frame imgur.com with some limitations, but even in this case, it is possible to carry out a proof of concept. One of the cases is in the /all/ directory of...

Self-XSS - Self-XSS Attack Using Bit.Ly To Grab Cookies Tricking Users Into Running Malicious Code

Self-XSS attack using bit.ly to grab cookies tricking users into running malicious code How it works? Self-XSS is a social engineering attack used to gain control of victims' web accounts by tricking users into copying and pasting malicious content into their browsers. Since Web browser vendors a...

Helium: HTTP request Smuggling

When malformed or abnormal HTTP requests are interpreted by one or more entities in the data flow between the user and the web server, such as a proxy or firewall, they can be interpreted inconsistently, allowing the attacker to "smuggle" a request to one device without the other device being awa...

Shopify: Self XSS in Timeline

Copy the url javascript: XSS payload to any Timeline, then click url will trigger XSS. F796167 F796161 I previously reported a storefront url XSS at 841361, then admin copy the url to Timeline is possibly. Impact Self XSS...

CVE-2020-10114

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

CVE-2020-10113

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

CVE-2019-20493

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...

Cross site scripting

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

Design/Logic Flaw

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

CVE-2020-10114

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

CVE-2020-10114

CVE-2020-10114 affects cPanel prior to 84.0.20. The vulnerability is described as a stored self‑XSS via the HTML file editor (SEC-535). The connected documents do not provide additional technical details such as affected components beyond the editor, exploit vectors, or concrete remediation steps...

CVE-2020-10113

cPanel before 84.0.20 allows self XSS via a temporary character-set specification SEC-515...

CVE-2019-20493

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...

CVE-2019-20493

CVE-2019-20493 affects cPanel prior to 82.0.18. The vulnerability is a self‑XSS caused by mishandled JSON string escaping (SEC-520). Exploitation would require user interaction and can originate from a network context, with a CVSS3.1 base score of 6.1 (MEDIUM) and CVSS2 score of 4.3 (MEDIUM) as d...

CVE-2019-20493: Improper Neutralization of Input During Web Page Generation

cPanel before 82.0.18 allows self-XSS because JSON string escaping is mishandled SEC-520...

CVE-2020-10114: Improper Neutralization of Input During Web Page Generation

cPanel before 84.0.20 allows stored self-XSS via the HTML file editor SEC-535...

PT-2020-10475

Name of the Vulnerable Software and Affected Versions cPanel versions prior to 82.0.18 Description The issue is related to self-XSS due to mishandled JSON string escaping. Recommendations For versions prior to 82.0.18, update to version 82.0.18 or later to resolve the issue...