PT-2020-20123

Name of the Vulnerable Software and Affected Versions Code Snippets plugin versions prior to 2.14.0 Description The issue allows for CSRF due to the lack of a Referer check on the import menu. This can potentially lead to WordPress site takeover. There are reports of this issue being exploited in...

Malwinx - Just A Normal Flask Web App To Understand Win32Api With Code Snippets And References

A normal flask web app to learn win32api with code snippets and references. Prerequisite You need to download the following package before starting it pip install flask pip install pefile pip install requests Usage $ python flaskapp.py Live Demo Here is the Walkthrough: 1. Upload the exe or dll. ...

Open-Xchange: SSRF - Image Sources in HTML Snippets - 727234 bypass

This is about incomplete fix for my recent bug 727234. In short, the /ajax/snippet?action=import endpoint allows to create HTML snippets. URLs of images are extracted from HTML and their content is fetched and attached to created snippet. For more details please see 727234. With the fix applied,...

WordPress Woody Ad Snippets plugin <= 2.2.7 - Authenticated Reflected Cross-Site Scripting (XSS) vulnerability

Authenticated Reflected Cross-Site Scripting XSS vulnerability found in WordPress Woody Ad Snippets plugin versions = 2.2.7. Solution Update the WordPress Woody Ad Snippets plugin to the latest available version at least 2.2.8...

Woody Ad Snippets <= 2.2.8 - Authenticated Cross-Site Scripting (XSS)

The Woody ad snippets – Insert Header Footer Code, AdSense Ads WordPress plugin was affected by an Authenticated Cross-Site Scripting XSS security vulnerability...

Exploit for Missing Authentication for Critical Function in Webcraftic Woody_Ad_Snippets

CVE-2019-15858 Unauthenticated Remote Code Execution at Wood...

WordPress Woody ad snippets Plugin < 2.2.5 Multiple Vulnerabilities

The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webcraftic:woodyadsnippets"; ifdescription...

GitLab: Project Template functionality can be used to copy private project data, such as repository, confidential issues, snippets, and merge requests

I've found a three minor vulnerabilities which, when combined, allow an attacker to copy private repositories, confidential issues, private snippets, and then some. I'll go through the code path to explain the vulnerabilities and how they are combined. See the Proof of Concept section if you want...

WordPress Woody ad snippets plugin cross-site scripting vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Woody ad snippets is used in one of the pages to add ads to the plugin. A cross-site scripting vulnerability exists in the WordPress...

CVE-2019-15858

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution...

CVE-2019-15858

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution...

CVE-2019-15858

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution...

CVE-2019-15858

CVE-2019-15858 concerns the WordPress plugin Woody Ad Snippets (before 2.2.5). The vulnerability arises in admin/includes/class.import.snippet.php, where an unauthenticated options import function can be abused to store a payload, enabling cross‑site scripting and, in turn, remote code execution....

PT-2019-14438

Name of the Vulnerable Software and Affected Versions Woody ad snippets plugin versions prior to 2.2.5 Description The issue allows unauthenticated options import, which can be exploited to store an XSS payload for remote code execution. Recommendations For versions prior to 2.2.5, update to...

CVE-2019-15858: Missing Authentication for Critical Function

admin/includes/class.import.snippet.php in the "Woody ad snippets" plugin before 2.2.5 for WordPress allows unauthenticated options import, as demonstrated by storing an XSS payload for remote code execution...

CVE-2018-20977

The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page...

CVE-2018-20977

The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page...

PT-2019-10413 · WordPress · All-In-One-Schemaorg-Rich-Snippets

Name of the Vulnerable Software and Affected Versions: all-in-one-schemaorg-rich-snippets plugin versions prior to 1.5.0 Description: The issue concerns a cross-site scripting XSS flaw on the settings page. Recommendations: For versions prior to 1.5.0, update to version 1.5.0 or later to resolve...

CVE-2018-20977: Improper Neutralization of Input During Web Page Generation

The all-in-one-schemaorg-rich-snippets plugin before 1.5.0 for WordPress has XSS on the settings page...

WordPress Woody Ad Snippets Plugin < 2.2.6 File Deletion Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:webcraftic:woodyadsnippets"; if description...