PT-2021-16003

Name of the Vulnerable Software and Affected Versions Event Geek WordPress plugin versions prior to 2.5.3 Description The issue is related to an authenticated stored Cross-Site Scripting problem. It occurs because the Use your own setting is not properly sanitised or escaped before being outputte...

Sitewide Notice WP < 2.3 - Authenticated Stored XSS

The plugin does not sanitise some of its settings before outputting them in frontend pages, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed Put the following payload in the Message setting of the plugin: alert/XSS/ The XS...

Business Hours Indicator < 2.3.5 - Authenticated Stored XSS

The plugin does not sanitise or escape its 'Now closed message" setting when outputting it in the backend and frontend, leading to an Authenticated Stored Cross-Site Scripting issue Put the following payload in the "Now closed message" setting and save them: alert/XSS/ Then refresh the setting...

WordPress plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The Any Hostname plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in WordPres...

PT-2021-16004

Name of the Vulnerable Software and Affected Versions Any Hostname WordPress plugin versions 1.0.0 through 1.0.6 Description The issue arises from the lack of sanitization or escaping of the "Allowed hosts" setting in the plugin, leading to an authenticated stored XSS issue. High privilege users...

LY Corporation: See drafts and post articles if the account owner hasn't set password (livedoor CMS plugin)

For new accounts that haven't set passwords yet, an attacker is able to see drafts or post articles as victims...

WPFront Scroll Top < 2.0.6.07225 - Authenticated Stored XSS

The plugin does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfilteredhtml capability is disallowed. PoC Put the one of the payload below in the Image ALT setting of the plugin: The XSS...

WPFront Scroll Top < 2.0.6.07225 - Authenticated Stored XSS

The plugin does not sanitise or escape its Image ALT setting before outputting it attributes, leading to an Authenticated Stored Cross-Site Scripting issues even when the unfilteredhtml capability is disallowed. Put the one of the payload below in the Image ALT setting of the plugin: The XSS will...

CVE-2021-22146

All versions of Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker could leverage the anonymous user to...

Elastic Cloud Enterprise security update

Elastic Cloud Enterprise security update ESA-2021-17 Elastic Cloud Enterprise has the Elasticsearch “anonymous” user enabled by default in deployed clusters. While in the default setting the anonymous user has no permissions and is unable to successfully query any Elasticsearch APIs, an attacker...

Shantz WordPress QOTD <= 1.2.2 - Arbitrary Setting Update via CSRF

The plugin is lacking any CSRF check when updating its settings, allowing attackers to make logged in administrators change them to arbitrary values...

VDZ CallBack < 1.14.6 - Authenticated Stored XSS

The plugin does not properly sanitise or escape some of its settings, allowing high privilege users such as admin to perform XSS attacks even when the unfilteredhtml capability is disallowed Put the following payload in the Title setting of the plugin...

Design/Logic Flaw

The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

PT-2021-19759

Name of the Vulnerable Software and Affected Versions: QSAN SANOS versions prior to 2.1.0 Description: The QSAN SANOS setting page does not filter special parameters, allowing remote attackers to inject and execute arbitrary commands without permissions. Recommendations: For versions prior to...

QSAN SANOS Operating System Command Injection Vulnerability

QSAN SANOS is the SAN storage management operating system from QSAN China. It comes with a refreshingly easy-to-use Web GUI and can be easily deployed into any infrastructure. An injection vulnerability exists in QSAN SANOS, which stems from the product's setting page not filtering user-entered...

CVE-2021-32533: Improper Neutralization of Special Elements used in an OS Command

The QSAN SANOS setting page does not filter special parameters. Remote attackers can use this vulnerability to inject and execute arbitrary commands without permissions. The referred vulnerability has been solved with the updated version of QSAN SANOS v2.1.0...

fly-admin-date Time Access Control DoS

The vulnerability of the software for setting the time in the fly-admin-date operating system is related to lack of access control. Exploiting this vulnerability allows a perpetrator to cause service failures...

CVE-2021-24388

In the VikRentCar Car Rental Management System WordPress plugin before 1.1.7, there is a custom filed option by which we can manage all the fields that the users will have to fill in before saving the order. However, the field name is not sanitised or escaped before being output back in the page,...

Atlassian Confluence < 7.11.0 Multiple Vulnerabilities

According to its self-reported version number, the Atlassian Confluence application running on the remote host is prior 7.11.0. It is, therefore, affected by the following vulnerabilities : - A blind Server-Side Request Forgery SSRF vulnerability in Team Calendars parameters. CVE-2020-29445 - A...

CVE-2020-23185

A stored cross site scripting XSS vulnerability in /administration/settingsecurity.php of PHP-Fusion 9.03.60 allows authenticated attackers to execute arbitrary web scripts or HTML via a crafted payload...