JFinalCMS Security Vulnerability

JFinalCMS is a content management system by heyewei personal developer. A security vulnerability exists in JFinalCMS v5.0.0, which originates from a cross-site request forgery vulnerability in the /admin/slide/delete component...

CVE-2023-49373

CVE-2023-49373 : JFinalCMS v5.0.0 is affected by a Cross-Site Request Forgery (CSRF) at the /admin/slide/delete endpoint. The vulnerability arises at that API point, enabling unauthorized actions if a user with an active session is induced to perform a request. The CVSS3.1 metrics describe a High...

CVE-2023-49374

Concretely, CVE-2023-49374 affects JFinalCMS v5.0.0 with a Cross-Site Request Forgery (CSRF) vulnerability exploitable via /admin/slide/update. The NVD entry reports a CVSS v3.1 base score of 8.8 (High) with Network attack vector, no privileges required, user interaction required, and impacts to ...

CVE-2023-28499

Auth. author+ Stored Cross-Site Scripting XSS vulnerability in simonpedge Slide Anything – Responsive Content / HTML Slider and Carousel plugin = 2.4.9 versions...

Cross site scripting

Auth. author+ Stored Cross-Site Scripting XSS vulnerability in simonpedge Slide Anything – Responsive Content / HTML Slider and Carousel plugin = 2.4.9 versions...

CVE-2023-28499

CVE-2023-28499 affects the WordPress plugin Slide Anything – Responsive Content / HTML Slider and Carousel . Vulnerable versions:

PT-2023-21762 · WordPress · Slide Anything

Name of the Vulnerable Software and Affected Versions: Slide Anything – Responsive Content / HTML Slider and Carousel plugin versions prior to 2.4.9 Description: The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject...

WordPress Plugin Slide Anything Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

An analysis of an in-the-wild iOS Safari WebContent to GPU Process exploit

By Ian Beer A graph representation of the sandbox escape NSExpression payload In April this year Google's Threat Analysis Group, in collaboration with Amnesty International, discovered an in-the-wild iPhone zero-day exploit chain being used in targeted attacks delivered via malicious link. The...

WordPress Slide Anything Plugin < 2.3.44 XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:slideanythingproject:slideanything"; ifdescription...

CVE-2021-4424

The Slider Hero plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.2.0. This is due to missing or incorrect nonce validation on the qcsliderheroduplicate function. This makes it possible for unauthenticated attackers to duplicate slides via a forg...

CVE-2023-23807

CVE-2023-23807 affects MojoPlug Slide Panel (WordPress plugin) version

CVE-2023-23807 WordPress MojoPlug Slide Panel Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Qumos MojoPlug Slide Panel plugin = 1.1.2 versions...

WordPress plugin MojoPlug Slide Panel 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

MojoPlug Slide Panel <= 1.1.2 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

WordPress MojoPlug Slide Panel Plugin <= 1.1.2 is vulnerable to Cross Site Scripting (XSS)

Software MojoPlug Slide Panel Type Plugin Vulnerable versions = 1.1.2 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-23807 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID a537c89d392b Credits Rio Darmawan Require...

Former Ubiquiti Employee Gets 6 Years in Jail for $2 Million Crypto Extortion Case

A former employee of Ubiquiti has been sentenced to six years in jail after he pleaded guilty to posing as an anonymous hacker and a whistleblower in an attempt to extort almost $2 million worth of cryptocurrency while working at the company. Nickolas Sharp, 37, was arrested in December 2021 for...

WordPress Slide Anything Plugin <= 2.4.9 is vulnerable to Cross Site Scripting (XSS)

Software Slide Anything Type Plugin Vulnerable versions = 2.4.9 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28499 Patch priority Medium CVSS severity Medium 5.9 Developer Claim ownership PSID 20dca4f988b8 Credits RE-ALTER Required...

Meteor Slides < 1.5.7 - Contributor+ Stored XSS

The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. meteorslidesh...

Sliderby10Web < 1.2.53 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup. 1. Go to "Slider » Sliders" and edit one of the...