WordPress SMS Alert Order Notifications – WooCommerce Plugin <= 3.6.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software SMS Alert Order Notifications – WooCommerce Type Plugin Vulnerable versions = 3.6.9 Fixed in 3.7.0 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-1489 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 78d3bccea7ab...

WP SMS < 6.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode

Description The WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcodes in all versions up to, and including, 6.3.4 due to insufficient input sanitization and output escaping ...

Chinese Hackers Using Deepfakes in Advanced Mobile Banking Malware Attacks

A Chinese-speaking threat actor codenamed GoldFactory has been attributed to the development of highly sophisticated banking trojans, including a previously undocumented iOS malware called GoldPickaxe that's capable of harvesting identity documents, facial recognition data, and intercepting SMS...

WordPress WP SMS Plugin <= 6.3.4 is vulnerable to Cross Site Scripting (XSS)

Software WP SMS Type Plugin Vulnerable versions = 6.3.4 Fixed in 6.4 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-25920 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 2e899db47af6 Credits Khalid Yusuf Required privilege Contributor...

4 Ways Hackers use Social Engineering to Bypass MFA

When it comes to access security, one recommendation stands out above the rest: multi-factor authentication MFA. With passwords alone being simple work for hackers, MFA provides an essential layer of protection against breaches. However, it's important to remember that MFA isn't foolproof. It can...

CVE-2024-24881

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & SMS Notification for WordPress,...

CVE-2024-24881

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & SMS Notification for WordPress,...

CVE-2024-24881 WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & SMS Notification for WordPress,...

CVE-2024-24881

CVE-2024-24881 is a Cross-Site Scripting (XSS) vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc. Affected versions are n/a through 6.5.2; root cause is improper input neutralization during web page generation, enabling reflected XSS. ...

CVE-2024-24881 WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc allows Reflected XSS.This issue affects WP SMS – Messaging & SMS Notification for WordPress,...

PT-2024-20637 · Veronalabs · Veronalabs Wp Sms

Name of the Vulnerable Software and Affected Versions: VeronaLabs WP SMS – Messaging & SMS Notification for WordPress, WooCommerce, GravityForms, etc versions n/a through 6.5.2 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-si...

WordPress Plugin WP SMS Cross-Site Scripting Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

WordPress WP SMS Plugin <= 6.5.2 is vulnerable to Cross Site Scripting (XSS)

Software WP SMS Type Plugin Vulnerable versions = 6.5.2 Fixed in 6.5.3 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-24881 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID d5cff7300aea Credits Dimas Maulana Required privilege...

WordPress WP SMS Plugin <= 6.5.1 is vulnerable to Cross Site Scripting (XSS)

Software WP SMS Type Plugin Vulnerable versions = 6.5.1 Fixed in 6.5.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE N/A Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID b81910d51fc0 Credits WordFence Required privilege Contributor...

CVE-2023-50127

Hozard alarm system Alarmsysteem v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionality are accepted from random phone numbers, which allows an attacker to bring the alarm system to a disarmed state from any given phone number...

CVE-2023-50123

The number of attempts to bring the Hozard Alarm system alarmsystemen v1.0 to a disarmed state is not limited. This could allow an attacker to perform a brute force on the SMS authentication, to bring the alarm system to a disarmed state...

Authentication flaw

The number of attempts to bring the Hozard Alarm system alarmsystemen v1.0 to a disarmed state is not limited. This could allow an attacker to perform a brute force on the SMS authentication, to bring the alarm system to a disarmed state...

Authentication flaw

Hozard alarm system Alarmsysteem v1.0 is vulnerable to Improper Authentication. Commands sent via the SMS functionality are accepted from random phone numbers, which allows an attacker to bring the alarm system to a disarmed state from any given phone number...

PHPJabbers Event Booking Calendar 4.0 Cross Site Scripting / HTML Injection

Exploit Title: PHPJabbers Event Booking Calendar v4.0 - Multiple Stored XSS Date: 19/12/2023 Exploit Author: BugsBD Limited Discover by: Rahad Chowdhury Vendor Homepage: https://www.phpjabbers.com/ Software Link: https://www.phpjabbers.com/event-booking-calendar/sectionDemo Version: v4.0 Tested o...

CVE-2023-50123

The CVE-2023-50123 entry concerns the Hozard Alarm system v1.0, where there is no limit on attempts to disarm via SMS authentication. The connected documents confirm the affected product and the root cause (unbounded attempt count enabling brute force to disarm). The impact is high (confidentiali...