CVE-2020-25033

The CVE-2020-25033 entry concerns the Blubrry Subscribe Sidebar WordPress plugin (version up to 1.3.1). The issue is a reflected XSS in subscribe_sidebar.php via the status parameter (e.g., ...?page=subscribe_sidebar.php&status=...), allowing script execution. Some sources label the flaw as authe...

CVE-2020-25033

The Blubrry subscribe-sidebar aka Subscribe Sidebar plugin 1.3.1 for WordPress allows subscribesidebar.php&status= reflected XSS...

WordPress Subscribe Sidebar plugin <= 1.3.1 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found by ZeroAptitude in WordPress Subscribe Sidebar plugin versions = 1.3.1. Solution 2020-12-28 - we were unable to find a patched version of this plugin. Notice from WordPress.org: "This plugin has been closed as of June 23, 2020 a...

Subscribe Sidebar <= 1.3.1 - Authenticated Reflected Cross-Site Scripting

The 'status' GET parameter in subscribesidebar.php, which is displayed in the plugin's option page, is vulnerable to reflected XSS attacks. /wp-admin/options-general.php?page=subscribesidebar.php&status=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E...

Subscribe Sidebar <= 1.3.1 - Authenticated Reflected Cross-Site Scripting

The 'status' GET parameter in subscribesidebar.php, which is displayed in the plugin's option page, is vulnerable to reflected XSS attacks. PoC /wp-admin/options-general.php?page=subscribesidebar.php=%3Cscript%3Ealert%28document.cookie%29%3C%2Fscript%3E...

PT-2020-15901 · Blubrry · Blubrry Subscribe-Sidebar Plugin

Name of the Vulnerable Software and Affected Versions: Blubrry subscribe-sidebar plugin version 1.3.1 Description: The issue allows for reflected XSS in the subscribe-sidebar.php file. This can be exploited through the status parameter. Recommendations: For version 1.3.1, update to a newer versio...

CVE-2019-11698

If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for...

openSUSE Security Update : opera (openSUSE-2020-402)

This update for opera fixes the following issues : Update to version 67.0.3575.97 - DNA-84063 Open URL in new tab with Go to web address in search/copy popup and right mouse click context menu - DNA-84780 Search in Search and Copy popup opens tab in wrong position from popup window - DNA-84786...

Security update for opera (moderate)

openSUSE Security Update: Security update for opera Announcement ID: openSUSE-SU-2020:0402-1 Rating: moderate References: Affected Products: openSUSE Leap 15.1:NonFree An update that contains security fixes can now be installed. Description: This update for opera fixes the following issues: Updat...

Nexos - Real Estate < 1.6.1 - SQL Injection & Persistent XSS

----- SQL Injection: ----- Vulnerable 'id' parameter is https://listing-themes.com/nexos-wp/wp-admin/admin.php?page=ownlistingaddlisting=8 ----- Persistent XSS: ----- You need a new user account, then go to any property listing on the website and use «ENQUIRY FORM» on the right sidebar...

DEBIAN-CVE-2019-11698

If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for...

Elite Graphix Elite CMS Pro SQL Injection Vulnerability

Elite Graphix Elite CMS Pro is a lightweight PHP and MySQL based content management system from Elite Graphix India. A SQL injection vulnerability exists in the '?page=' parameter of the /admin/addsidebar.php file in Elite Graphix Elite CMS Pro version 2.01, which stems from a lack of validation ...

CVE-2018-12250

An issue was discovered in Elite CMS Pro 2.01. In /admin/addsidebar.php, the ?page= parameter is vulnerable to SQL injection...

CVE-2019-11698

If a crafted hyperlink is dragged and dropped to the bookmark bar or sidebar and the resulting bookmark is subsequently dragged and dropped into the web content area, an arbitrary query of a user's browser history can be run and transmitted to the content page via drop event data. This allows for...

Fedora 27 : php-horde-horde (2018-1de045298c)

Horde 5.2.20 - mjr SECURITY: Fix XSS vulnerability when rendering custom background colors in a sidebar row Bug 14857. Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website. Tenable has attempted to automatically clean and...

CVE-2016-9070

A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections. This vulnerability affects Firefox 50...

CVE-2016-9070

A maliciously crafted page loaded to the sidebar through a bookmark can reference a privileged chrome window and engage in limited JavaScript operations violating cross-origin protections. This vulnerability affects Firefox 50...

Jenkins Sidebar Link Plugin Cross-Site Scripting Vulnerability

CloudBees Jenkins is the United States CloudBees company's set of Java-based development of continuous integration tools , it is mainly used to monitor the continuous software version of the release/testing project and some of the timed execution of the task . Sidebar Link plugin is one of the...

MyBB Recent Threads On Index 17.0 Cross Site Scripting

Exploit Title: MyBB Recent threads Date: 4th April 2018 Exploit Author: Perileos Software Link: https://community.mybb.com/mods.php?action=view&pid=191 Version: 17.0 Tested on: Windows 10 1. Description: This plugin shows recent threads in the side bar on your MyBB forum. 2. Proof of concept:...

CVE-2017-1000088

The Sidebar Link plugin allows users able to configure jobs, views, and agents to add entries to the sidebar of these objects. There was no input validation, which meant users were able to use javascript: schemes for these links...