CVE-2020-35939

PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action mus...

CVE-2020-35937

Stored Cross-Site Scripting XSS vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to...

Design/Logic Flaw

PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action mus...

CVE-2020-35939

CVE-2020-35939 affects the Team Showcase plugin for WordPress (and related Post Grid/Team Showcase context) with PHP Object Injection via insecure unserialization in the source parameter over AJAX when action=team_import_xml_layouts. It requires authentication (remote authenticated attacker) and ...

CVE-2020-35939

PHP Object injection vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to inject arbitrary PHP objects due to insecure unserialization of data supplied in a remotely hosted crafted payload in the source parameter via AJAX. The action mus...

CVE-2020-35937

CVE-2020-35937 affects the WordPress Post Grid/Team Showcase plugin: stored XSS in Team Showcase before 1.22.16 via AJAX import of layouts (team_import_xml_layouts) where the source parameter can carry crafted JavaScript. Requires authenticated access; impact is partial confidentiality/integrity/...

CVE-2020-35937

Stored Cross-Site Scripting XSS vulnerabilities in the Team Showcase plugin before 1.22.16 for WordPress allow remote authenticated attackers to import layouts including JavaScript supplied via a remotely hosted crafted payload in the source parameter via AJAX. The action must be set to...

WordPress Team Showcase plugin cross-site scripting vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the Team Showcase plugin before 1.22.16 for WordPress...

WordPress Code Issues Vulnerabilities

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability in the Team Showcase plugin before 1.22.16 for WordPress allows remotely...

IncomCMS File Upload Vulnerability

Incomcms is a website builder for Incomcms individual developers. A file upload vulnerability exists in IncomCMS version 2.0, which originates from the modules/uploader/showcase/script.php unsafe file upload vulnerability. An attacker can exploit this vulnerability to upload files to the server...

CVE-2020-29597

IncomCMS 2.0 has a modules/uploader/showcase/script.php insecure file upload vulnerability. This vulnerability allows unauthenticated attackers to upload files into the server...

pghbridalshowcase.com Cross Site Scripting vulnerability OBB-1476294

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

WordPress Super Logos Showcase premium plugin <= 2.2 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability found by Eagle Eye in WordPress Super Logos Showcase premium plugin versions = 2.2. Solution Update the WordPress Super Logos Showcase premium plugin to the latest available version at least 2.3...

pghbridalshowcase.com Cross Site Scripting vulnerability OBB-1418526

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

Post Grid WordPress Plugin Flaws Allow Site Takeovers

Two high-severity vulnerabilities in Post Grid, a WordPress plugin with more than 60,000 installations, opens the door to site takeovers, according to researchers. To boot, nearly identical bugs are also found in Post Grid’s sister plug-in, Team Showcase, which has 6,000 installations. The issues...

Post Grid < 2.0.73 & Team Showcase < 1.22.16 - PHP Object Injection

Ram Gall from Wordfence discovered an authenticated subscriber+ PHP Object Injection vulnerability in the Post Grid and Team Showcase WordPress plugins...

WordPress Team Showcase plugin <= 1.22.15 - PHP Object Injection vulnerability

PHP Object Injection vulnerability found by Ramuel Gall Wordfence in WordPress Team Showcase plugin versions = 1.22.15. Solution Update the WordPress Team Showcase plugin to the latest available version at least 1.22.16...

WordPress Team Showcase plugin <= 1.22.15 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Ramuel Gall Wordfence in WordPress Team Showcase plugin versions = 1.22.15. Solution Update the WordPress Team Showcase plugin to the latest available version at least 1.22.16...

XSS Vulnerability in IF Cloud Technology's Website Builder Showcase System

Fuzhou Yihu Cloud Technology Co. was founded on December 17, 2018 . The company's business scope includes: application software development; cloud software services; information technology consulting services; technology development, technology transfer, technology consulting, and technology...

XSS Vulnerability in Station Hi Display Building System

The Station Hi Showcase website builder is a self-service free website builder. A XSS vulnerability exists in StationHi Presentation builder, which can be exploited by attackers to inject arbitrary web script or HTML...