CVE-2020-23241

Cross Site Scripting XSS vulnerability in CMS Made Simple 2.2.14 in "Extra" via 'News Article" feature...

CVE-2020-23241

CMS Made Simple 2.2.14 is affected by a Cross-Site Scripting (XSS) vulnerability in the “Extra” via the News > Article feature. The issue is documented across multiple sources, indicating the vulnerable component is the News > Article path in the CMS Made Simple 2.2.14 implementation, with ...

CVE-2020-23240

Cross Site Scripting XSS vulnerablity in CMS Made Simple 2.2.14 via the Logic field in the Content Manager feature...

CVE-2020-23240

CMS Made Simple 2.2.14 is vulnerable to Cross-Site Scripting via the Logic field in the Content Manager (XSS). The issue is documented across NVD/CVE records and mirrored by Red Hat and CNVD entries. The OpenVAS entry notes a WillNotFix remediation in its data; no patch/version fix is provided in...

Simple Banner < 2.10.4 - Authenticated Stored XSS

The plugin does not sanitise and escape one of its settings, allowing high privilege users such as admin to use Cross-Site Scripting payload even when the unfilteredhtml capability is disallowed. Put the following payload in the Simple Banner Text setting of the plugin: The XSS will be triggered ...

CMS Made Simple 跨站脚本漏洞

CMS Made Simple is a simple and easy-to-use content management system developed using PHP, MySQL, and Smarty template engine. version 2.2.14 of CMS Made Simple contains a cross-site scripting vulnerability. The vulnerability can be exploited by attackers via the "Extra" function in the "News...

WordPress Simple Banner plugin <= 2.10.3 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Asif Nawaz Minhas in WordPress Simple Banner plugin versions = 2.10.3. Solution Update the WordPress Simple Banner plugin to the latest available version at least 2.10.4...

Simple Banner < 2.10.4 - Authenticated Stored XSS

The plugin does not sanitise and escape one of its settings, allowing high privilege users such as admin to use Cross-Site Scripting payload even when the unfilteredhtml capability is disallowed. PoC Put the following payload in the Simple Banner Text setting of the plugin: The XSS will be...

Simple Events Calendar <= 1.4.0 - Authenticated (admin+) SQL Injection

The plugin does not sanitise, validate or escape the eventid POST parameter before using it in a SQL statement when deleting events, leading to an authenticated SQL injection issue POST /wp-admin/admin.php?page=simple-events&tab=existingevents HTTP/1.1 Content-Length: 33 Cache-Control: max-age=0...

Simple Post <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitize user input when an authenticated user Text value, then it does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue. 1. Install WordPress 5.7.2 2. Install and activate Simple Post 3. Navigate to...

WordPress Simple Post 1.1 Plugin - (Text field) Stored Cross-Site Scripting Vulnerability

Exploit Title: WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting XSS Exploit Author: Vikas Srivastava Software Link: https://wordpress.org/plugins/simple-post/ Version: 1.1 Category: Web Application Tested on Mac How to Reproduce this Vulnerability: 1. Install WordPress...

WordPress Simple Post plugin <= 1.1 - Stored Cross-Site Scripting (XSS) vulnerability

Stored Cross-Site Scripting XSS vulnerability discovered by Vikas Srivastava in WordPress Simple Post plugin versions = 1.1. Solution This plugin has been closed as of July 23, 2021 and is not available for download. This closure is temporary, pending a full review...

Simple Post <= 1.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitize user input when an authenticated user Text value, then it does not escape these values when outputting to the browser leading to an Authenticated Stored XSS Cross-Site Scripting issue. PoC 1. Install WordPress 5.7.2 2. Install and activate Simple Post 3. Navigate to...

WordPress Simple Post 1.1 Cross Site Scripting

Exploit Title: WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting XSS Date: 23/07/2021 Exploit Author: Vikas Srivastava Software Link: https://wordpress.org/plugins/simple-post/ Version: 1.1 Category: Web Application Tested on Mac How to Reproduce this Vulnerability: 1...

WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting (XSS)

Exploit Title: WordPress Plugin Simple Post 1.1 - 'Text field' Stored Cross-Site Scripting XSS Date: 23/07/2021 Exploit Author: Vikas Srivastava Software Link: https://wordpress.org/plugins/simple-post/ Version: 1.1 Category: Web Application Tested on Mac How to Reproduce this Vulnerability: 1...

CVE-2021-26232

SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via the id parameter to news.php...

CVE-2021-26232

SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via the id parameter to news.php...

CVE-2021-26232

SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via the id parameter to news.php...

Sql injection

SQL injection vulnerability in SourceCodester Simple College Website v 1.0 allows remote attackers to execute arbitrary SQL statements via the id parameter to news.php...

CVE-2021-26232

The CVE-2021-26232 entry concerns SourceCodester Simple College Website v1.0. The vulnerability is a SQL injection in News.php via the id parameter, enabling remote attackers to execute arbitrary SQL statements. Affected software: SourceCodester Simple College Website (CMS) v1.0; vulnerable compo...