WordPress 插件跨站脚本漏洞

WordPress is a blogging platform developed by the Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.The Migrate Users plugin is an application plugin for WordPress. A cross-site scripting vulnerability exists in the...

Migrate Users <= 1.0.1 - CSRF to Stored Cross-Site Scripting (XSS)

The plugin does not sanitise or escape its Delimiter option before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its options, allowing the issue to be exploited via a CSRF attack. PoC Add the following...

CVE-2019-14683

The codection "Import users from CSV with meta" plugin before 1.14.2.2 for WordPress allows wp-admin/admin-ajax.php?action=acuideleteattachment CSRF...

Wordpress Export Users to CSV 1.1.1 Plugin - CSV Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Plugin Export Users to CSV 1.1.1 - CSV Injection Exploit Author: Javier Olmedo Website: https://hackpuntes.com Vendor: Matt Cromwell Software Link: https://wordpress.org/plugins/export-users-to-csv/ Affected Version:...

Monstra CMS Security Bypass Vulnerability

Monstra CMS is a lightweight PHP-based content management system CMS developed by Ukrainian software developer Sergey Romanenko. The system is easy to install and use, scalable and so on. A security vulnerability exists in the plugins/box/users/users.plugin.php file in Monstra CMS version 3.0.4. ...

October CMS Users Plugin Cross-Site Scripting Vulnerability

October CMS is a Canadian software developer Alexey Bobkov and Australian software developer Samuel Georges developed a set of open source, self-hosted built on the Laravel PHP framework content management system CMS. users also known as Front-end user management is used in one of the front-end...

CVE-2018-10366

An issue was discovered in the Users aka Front-end user management plugin 1.4.5 for October CMS. XSS exists in the name field...

CVE-2018-10366

An issue was discovered in the Users aka Front-end user management plugin 1.4.5 for October CMS. XSS exists in the name field...

CVE-2018-10366

The CVE-2018-10366 entry corresponds to a stored/reflected Cross-Site Scripting (XSS) in the October CMS Users plugin (rainlab-user) version 1.4.5, where the name field is susceptible to XSS. The vulnerability is tied to the front-end user management feature and is active in 1.4.5 with PoC eviden...

CVE-2018-10366

An issue was discovered in the Users aka Front-end user management plugin 1.4.5 for October CMS. XSS exists in the name field...

PT-2018-9851

Name of the Vulnerable Software and Affected Versions: Users plugin version 1.4.5 for October CMS Description: A cross-site scripting XSS issue exists in the name field of the Users plugin for October CMS. Recommendations: For version 1.4.5, consider disabling the name field in the Users plugin...

PT-2018-17698

Name of the Vulnerable Software and Affected Versions Z-BlogPHP version 1.5.1 Description The issue allows for CSRF via "zb users/plugin/AppCentre/app del.php", which can be exploited to delete files and directories. Recommendations For Z-BlogPHP version 1.5.1, consider restricting access to the...

WordPress Email Users Plugin <= 4.8.3 - Cross Site Request Forgery

Because of this vulnerability, attackers can send arbitrary bulk email messages to any address. Solution Update the plugin...

WordPress Email Users Plugin <= 4.8.2 - Reflected Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Update the plugin...

MyBB Follower User Plugin - SQL Injection

MyBB Follower User Plugin - SQL Injection Exploit Title: Follower User MyBB plugin SQL Injection 0day Google Dork: intext:"Users subscribed to" inurl:member.php -site:fwcombie.us Date: 13.10.2012 Exploit Author: Zixem Software Link: http://mods.mybb.com/view/suscriber-user Version: 1.5+ Tested on...

Sql injection

SQL injection vulnerability in wp-users.php in WordPress Users plugin 1.3 and possibly earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the uid parameter to index.php...

CVE-2011-4669

The CVE-2011-4669 entry concerns a SQL injection in the WordPress Users plugin (wp-users.php) version 1.3 and potentially earlier. The vulnerability allows remote attackers to inject arbitrary SQL via the uid parameter to index.php, enabling unauthorized database operations. Root cause is imprope...