CVE-2021-29056

Cross Site Scripting XSS vulnerability exists in Pixelimity 1.0 via the HTTP POST parameter to admin/setting.php...

CVE-2021-24534

The PhoneTrack Meu Site Manager WordPress plugin through 0.1 does not sanitise or escape its "phpid" setting before outputting it back in an attribute in the page, leading to a stored Cross-Site Scripting issue...

Per Page Add to Head <= 1.4.4 - Authenticated Stored XSS

The plugin does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfilteredhtml capability is disallowed, which could lead to Cross-Site Scripting issues. Note: The plugin is no longer maintained. Put the following payload in t...

Per Page Add to Head <= 1.4.4 - Authenticated Stored XSS

The plugin does not properly sanitise one of its setting, allowing malicious HTML to be inserted by high privilege users even when the unfilteredhtml capability is disallowed, which could lead to Cross-Site Scripting issues. Note: The plugin is no longer maintained. PoC Put the following payload ...

PT-2021-1173

Name of the Vulnerable Software and Affected Versions: NetworkManager affected versions not specified Description: The issue concerns NetworkManager, a system network service that manages network devices and connections. It affects the service's ability to correctly set the hostname to localhost...

CVE-2021-22385: Exposure of Resource to Wrong Sphere

A component of the Huawei smartphone has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause Kernel Code Execution...

AddToAny < 1.7.46 - Authenticated Stored XSS

The plugin does not sanitise its Sharing Header setting when outputting it in frontend pages, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in the Sharing Header setting of the...

AZL-6584 CVE-2021-38200 affecting package kernel for versions less than 5.10.78.1-1

arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perfeventparanoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service perfinstructionpointer NULL pointer dereference and OOPS via a "perf record" command...

CVE-2021-38200

arch/powerpc/perf/core-book3s.c in the Linux kernel before 5.12.13, on systems with perfeventparanoid=-1 and no specific PMU driver support registered, allows local users to cause a denial of service perfinstructionpointer NULL pointer dereference and OOPS via a "perf record" command...

Highlight < 0.9.3 - Authenticated Stored Cross-Site Scripting

The plugin does not sanitise its CustomCSS setting, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed PoC Tick the "Enable Highlight" setting of the plugin, and put the following payload in the CustomCSS setting as well:...

WP Mapa Politico Espana < 3.7.0 - Authenticated Stored Cross-Site Scripting

The plugin does not sanitise or escape some of its settings before outputting them in attributes, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml is disallowed Put the following payload in any of the Maps Zona setting fields such as A Coruna:...

Ransomware Volumes Hit Record Highs as 2021 Wears On

Ransomware has seen a significant uptick so far in 2021, with global attack volume increasing by 151 percent for the first six months of the year as compared with the year-ago half. Meanwhile, the FBI has warned that there are now 100 different strains circulating around the world. From a...

CVE-2021-22420

A component of the HarmonyOS has a External Control of System or Configuration Setting vulnerability. Local attackers may exploit this vulnerability to cause the underlying trust of the application trustlist mechanism is missing...

CVE-2021-34628

The Admin Custom Login WordPress plugin is vulnerable to Cross-Site Request Forgery due to the loginbgSave action found in the /includes/Login-form-setting/Login-form-background.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 3.2.7...

CVE-2021-24478

The Bookshelf WordPress plugin through 2.0.4 does not sanitise or escape its "Paypal email address" setting before outputting it in the page, leading to an authenticated Stored Cross-Site Scripting issue...

PT-2021-16003

Name of the Vulnerable Software and Affected Versions Event Geek WordPress plugin versions prior to 2.5.3 Description The issue is related to an authenticated stored Cross-Site Scripting problem. It occurs because the Use your own setting is not properly sanitised or escaped before being outputte...

Sitewide Notice WP < 2.3 - Authenticated Stored XSS

The plugin does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in the Message setting of the plugin: alert/XSS/ The XS...

Business Hours Indicator < 2.3.5 - Authenticated Stored XSS

The plugin does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue Put the following payload in the "Now closed message" setting and save them: alert/XSS/ Then refresh the setting...

PT-2021-16004

Name of the Vulnerable Software and Affected Versions Any Hostname WordPress plugin versions 1.0.0 through 1.0.6 Description The issue arises from the lack of sanitization or escaping of the "Allowed hosts" setting in the plugin, leading to an authenticated stored XSS issue. High privilege users...

WordPress 插件跨站脚本漏洞

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The Any Hostname plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in WordPres...