Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated Stored XSS

The plugin does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins. On a clean Wordpress on localhost: 1. Modify the Shoutboxalias cookie with a value such as 2. Send...

Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated Stored XSS

The plugin does not sanitise and escape a parameter before outputting it back in the Shoutbox, leading to Stored Cross-Site Scripting which could be used against high privilege users such as admins. PoC On a clean Wordpress on localhost: 1. Modify the Shoutboxalias cookie with a value such as 2...

PHPFusion Cross-Site Scripting Vulnerability (CNVD-2021-57462)

PHPFusion is a lightweight open source content management system. PHPFusion version 9.03.60 is vulnerable to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to conduct cross-site scripting attacks via 'New Shout' in /infusions/shoutboxpanel/shoutboxadmin.php...

CVE-2020-23702

Cross Site Scripting XSS vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutboxpanel/shoutboxadmin.php...

Cross site scripting

Cross Site Scripting XSS vulnerability in PHP-Fusion 9.03.60 via 'New Shout' in /infusions/shoutboxpanel/shoutboxadmin.php...

PHP-Fusion 跨站脚本漏洞

PHPFusion is a lightweight open source content management system. PHPFusion version 9.03.60 is vulnerable to a cross-site scripting vulnerability. An attacker can exploit this vulnerability to conduct cross-site scripting attacks via 'New Shout' in /infusions/shoutboxpanel/shoutboxadmin.php...

Php-Fusion Injection Vulnerability

Php-fusion PHP-Fusion is an open source lightweight content management system based on MySql and PHP from Malaysia's PHP-Fusion Php-fusion. The system contains modules for news, articles and forums. PHP-Fusion suffers from an injection vulnerability that stems from a flaw in a component in...

CVE-2020-23182

The component /php-fusion/infusions/shoutboxpanel/shoutboxarchive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel...

CVE-2020-23182

The component /php-fusion/infusions/shoutboxpanel/shoutboxarchive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel...

Code injection

The component /php-fusion/infusions/shoutboxpanel/shoutboxarchive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel...

CVE-2020-23182

The component /php-fusion/infusions/shoutboxpanel/shoutboxarchive.php in PHP-Fusion 9.03.60 allows attackers to redirect victim users to malicious websites via a crafted payload entered into the Shoutbox message panel...

CVE-2020-23182

CVE-2020-23182 affects PHP-Fusion version 9.03.60, specifically the component /php-fusion/infusions/shoutbox_panel/shoutbox_archive.php. The vulnerability allows an attacker to redirect victims to malicious websites via a crafted payload entered into the Shoutbox message panel. NVD data lists two...

Php-fusion PHP-Fusion 输入验证错误漏洞

Php-fusion PHP-Fusion is an open source lightweight content management system based on MySql and PHP from Malaysia's PHP-Fusion Php-fusion. The system contains modules for news, articles and forums. PHP-Fusion suffers from an injection vulnerability that stems from a flaw in a component in...

PHPFusion < 9.03.100 Multiple Vulnerabilities

PHPFusion is prone to multiple vulnerabilities. Copyright C 2021 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...

PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery (Delete admin shoutbox message)

Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery Delete admin shoutbox message Date: 2020-12-21 Exploit Author: Mohamed Oosman B S Vendor Homepage: https://www.php-fusion.co.uk/ Software Link: https://www.php-fusion.co.uk/phpfusion9downloads.php Version: 9.03.90 and below Tested...

PHP-Fusion 9.03.90 Cross Site Request Forgery

Exploit Title: PHP-Fusion CMS 9.03.90 - Cross-Site Request Forgery Delete admin shoutbox message Date: 2020-12-21 Exploit Author: Mohamed Oosman B S Vendor Homepage: https://www.php-fusion.co.uk/ Software Link: https://www.php-fusion.co.uk/phpfusion9downloads.php Version: 9.03.90 and below Tested...

PHPFusion Cross-Site Request Forgery Vulnerability

PHPFusion is a lightweight open source content management system. PHPFusion 9.03.90 suffers from a cross-site request forgery vulnerability. An attacker can exploit this vulnerability to delete all shoutbox messages on behalf of a logged-in victim...

CVE-2020-35687

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim...

CVE-2020-35687

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim...

Cross site request forgery (csrf)

PHPFusion version 9.03.90 is vulnerable to CSRF attack which leads to deletion of all shoutbox messages by the attacker on behalf of the logged in victim...