549 matches found
sellmywatchmiami.com Cross Site Scripting vulnerability OBB-2278556
Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...
WordPress Sell Media plugin <= 2.5.5 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability discovered by Jerome Bruandet NinTechNet in WordPress Sell Media plugin versions = 2.5.5. Solution Update the WordPress Sell Media plugin to the latest available version at least 2.5.6...
Shopify: Store Deletion or Sell without authentication
In order for an owner to "close or sell" the store, a password is required in order to confirm the decision, when the action is applied in the web application. It was identified that the mobile application doesn't require credentials in order to perform the same action, thus by navigating to the...
CVE-2020-4918: Authorization Bypass Through User-Controlled Key
IBM Cloud Pak System 2.3 could allow l local privileged user to disclose sensitive information due to an insecure direct object reference in sell service console for the Platform System Manager. IBM X-Force ID: 191392...
PT-2021-12232
Name of the Vulnerable Software and Affected Versions IBM Cloud Pak System version 2.3 Description The issue allows a local privileged user to disclose sensitive information due to an insecure direct object reference in the sell service console for the Platform System Manager. Recommendations For...
The Edge of a Storm?
The SolarWinds element of this breach is likely just the tip of the iceberg as many more businesses leveraging their management tools are exposed to this compromise. Not necessarily from the nation state actor believed to have triggered it, but from the potential sell off of those points of acces...
property-sell-europe.com Cross Site Scripting vulnerability OBB-1473498
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
sell-cartier.co.uk Cross Site Scripting vulnerability OBB-1373373
Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has:       a. verified the vulnerability and confirmed its existence;       b. notified the website operator about its existence...
CS Money: Improper authentication in the load sell inventory page
Summary: Hello team, I found an endpoint response all data relate to sell mode inventory that doesn't have improper authentication in the link: https://cs.money/loadsellmodeinventory Steps To Reproduce: add details for how we can reproduce the issue 1. Open directly the link:...
WordPress NextGen Gallery Sell Photo Plugin Cross Site Scripting
A cross-site scripting vulnerability exists in WordPress NextGen Gallery Sell Photo Plugin. Successful exploitation of this vulnerability would allow remote attackers to inject arbitrary web script into the affected system...
WordPress Sell Media Cross-Site Scripting Vulnerability
The WordPress plugin Sell Media is a tailored e-commerce solution that allows you to sell photos, prints, and videos through your self-hosted WordPress website. A cross-site scripting vulnerability exists in the /inc/class-search.php file in WordPress Sell Media v2.4.1. The vulnerability stems fr...
Sell Photo <= 1.0.5 - Authenticated Stored Cross-Site Scripting
The Button Text/Image field in Settings page of Sell Photos Plugin was found to be vulnerable to stored XSS, as they did not sanitize user given input properly. It is triggered when a users loads a page where the plugin is used, and when an admin opens settings page of the plugin. PoC The PoC wil...
Sell Photo <= 1.0.5 - Authenticated Stored Cross-Site Scripting
The Button Text/Image field in Settings page of Sell Photos Plugin was found to be vulnerable to stored XSS, as they did not sanitize user given input properly. It is triggered when a users loads a page where the plugin is used, and when an admin opens settings page of the plugin. The PoC will be...
WordPress Sell Photo plugin <= 1.0.5 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability found by Melbin K Mathew in WordPress Sell Photo plugin versions = 1.0.5. Solution 2021-01-06 - we were unable to find a patched version of this plugin. Notification from WordPress.org - "This plugin has been closed as of August 17, 2020...
NextGEN Gallery Sell Photo <= 1.0.4 - Authenticated Stored Cross-Site Scripting
The Button Text/Image field in Settings page of Sell Photos Plugin was found to be vulnerable to stored XSS, as they did not sanitize user given input properly. It is triggered when a users loads a page where the plugin is used, and when an admin opens settings page of the plugin. The PoC will be...
NextGEN Gallery Sell Photo <= 1.0.4 - Authenticated Stored Cross-Site Scripting
The Button Text/Image field in Settings page of Sell Photos Plugin was found to be vulnerable to stored XSS, as they did not sanitize user given input properly. It is triggered when a users loads a page where the plugin is used, and when an admin opens settings page of the plugin. PoC The PoC wil...
WordPress NextGEN Gallery Sell Photo plugin <= 1.0.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability found by Melbin K Mathew in WordPress NextGEN Gallery Sell Photo plugin versions = 1.0.4. Solution 2021-01-06 - we were unable to find a patched version of this plugin. Notification from WordPress.org - "This plugin has been closed as of...
WordPress NextGen Gallery Sell Photo 1.0.5 Cross Site Scripting
Exploit Title: Wordpress Plugin NextGen Gallery Sell Photo 1.0.5 - Persistent Cross-Site Scripting Date: 2020-08-14 Vendor Homepage: https://noorsplugin.com/ Vendor Changelog: https://wordpress.org/plugins/nextgen-gallery-sell-photo/developers Exploit Author: Melbin K Mathew @melbinkm Author...
WordPress Sell Photo 1.0.5 Cross Site Scripting Vulnerability
Exploit for php platform in category web applications Exploit Title: Sell Photo Wordpress Plugin v1.0.5 - Persistent Cross-Site Scripting Vendor Homepage: https://noorsplugin.com/ Vendor Changelog: https://wordpress.org/plugins/sell-photo/developers Exploit Author: Melbin K Mathew @melbinkm Autho...
CVE-2019-6112
A Cross-site scripting XSS vulnerability in /inc/class-search.php in the Sell Media plugin v2.4.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the keyword parameter aka $searchterm or the Search field...