WordPress Testimonial Builder plugin <= 1.6.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Ngo Van Thien Patchstack Alliance in WordPress Testimonial Builder plugin versions = 1.6.1. Solution Update the WordPress Testimonial plugin to the latest available version at least 1.6.2...

WordPress Age Gate plugin <= 2.17.0 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability was discovered by Nguyen Van Khanh Patchstack Alliance in the WordPress Age Gate plugin versions = 2.17.0. Solution Update the WordPress Age Gate plugin to the latest available version at least 2.17.1...

Paul van Oorschot’s Computer Security and the Internet

Paul van Oorschots webpage contains a complete copy of his book: Computer Security and the Internet: Tools and Jewels. Its worth reading...

Supreme Court Limits Scope of Controversial Hacking Law

The United States Supreme Court has ruled that a police officer who received money for obtaining data from a law-enforcement database for an associate did not violate a controversial federal hacking law, marking a victory for the ethical hacking community by limiting the law’s scope. In a landmar...

Supreme Court narrows CFAA

The US Supreme Court issued its long-awaited-by-cybersecurity-nerds opinion on Van Buren v. United States. The case examined whether it was a violation of the Computer Fraud and Abuse Act CFAA for a police officer to access a law enforcement database to obtain information, which the officer then...

WordPress XCloner Backup, Restore and Migrate plugin <= 4.2.161 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Ngo Van Thien Sun Research & Development WordPress XCloner Backup, Restore and Migrate plugin versions = 4.2.161. Solution Update the WordPress XCloner Backup, Restore and Migrate plugin to the latest available version at least 4.2.163...

WordPress CMP – Coming Soon & Maintenance plugin <= 4.0.9 - Authenticated Remote Code Execution (RCE) vulnerability

Remote Code Execution RCE vulnerability discovered by Ngo Van Thien Sun Cyber Security Research Team Patchstack Red Team member in WordPress CMP – Coming Soon & Maintenance plugin versions = 4.0.9. Solution Update the WordPress CMP – Coming Soon & Maintenance plugin to the latest available versio...

WordPress Media File Renamer plugin <= 5.1.9 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability discovered by Ngo Van Thien Patchstack Red Team in the WordPress Media File Renamer plugin versions = 5.1.9. Affected parameters "posttitle", "filename", "lock". This allows changing the uploaded media title, media file name, and media locking state...

WordPress Backup Guard plugin <= 1.5.9 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability found by Nguyen Van Khanh in WordPress Backup Guard plugin versions = 1.5.9. Solution Update the WordPress Backup Guard plugin to the latest available version at least 1.6.0...

WordPress Theme Editor plugin <= 2.5 - Multiple Authenticated Arbitrary File Download vulnerabilities

Multiple Authenticated Arbitrary File Download vulnerabilities found by Nguyen Van Khanh and WPScan security research team in WordPress Theme Editor plugin versions = 2.5. Solution Update the WordPress Theme Editor plugin to the latest available version at least 2.6...

WordPress Modern Events Calendar Lite plugin <= 5.16.2 - Authenticated Arbitrary File Upload to Remote Code Execution (RCE) vulnerability

Authenticated Arbitrary File Upload to Remote Code Execution RCE vulnerability found by Nguyen Van Khanh in WordPress Modern Events Calendar Lite plugin versions = 5.16.2. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.16.5...

WordPress Modern Events Calendar Lite plugin <= 5.16.5 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found by Nguyen Van Khanh in WordPress Modern Events Calendar Lite plugin versions = 5.16.5. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.16.6...

WordPress Modern Events Calendar Lite plugin <= 5.16.2 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Nguyen Van Khanh in WordPress Modern Events Calendar Lite plugin versions = 5.16.2. Solution Update the WordPress Modern Events Calendar Lite plugin to the latest available version at least 5.16.5...

Cryptologists Crack Zodiac Killer's 340 Cipher

A remote team of three hobbyist cryptologists have solved one of the Zodiac Killer’s cipher after a half century. And while the name of the elusive serial killer remains hidden, the breakthrough represents a triumph for cryptology and the basic building blocks of cybersecurity — access control an...

WordPress Events Manager plugin <= 5.9.8.1 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability

Authenticated Stored Cross-Site Scripting XSS vulnerability found by Nguyen Van Khanh in WordPress Events Manager plugin versions = 5.9.8.1. Solution 2020-11-25 - we were unable to find a patched version of this plugin use at your own risk, we recommend to deactivate and delete the plugin until t...

CMS Made Simple 2.2.14 - Persistent Cross-Site Scripting (Authenticated)

Exploit Title: CMS Made Simple 2.2.14 - Persistent Cross-Site Scripting Authenticated Google Dork: - Date: 2020-09-29 Exploit Author: Roel van Beurden Vendor Homepage: https://www.cmsmadesimple.org/ Software Link: http://s3.amazonaws.com/cmsms/downloads/14793/cmsms-2.2.14-install.zip Version:...

removalvanilford.co.uk Cross Site Scripting vulnerability OBB-1359142

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...

WordPress Autoptimize plugin <= 2.7.6 - Authenticated Arbitrary File Upload vulnerability

Authenticated Arbitrary File Upload vulnerability found by Nguyen Van Khanh SunCSR in WordPress Autoptimize plugin versions = 2.7.6. Solution Update the WordPress Autoptimize plugin to the latest available version at least = 2.7.7...

Fuel CMS 1.4.7 - (col) SQL Injection (Authenticated) Vulnerability

Exploit for php platform in category web applications Exploit Title: Fuel CMS 1.4.7 - 'col' SQL Injection Authenticated Exploit Author: Roel van Beurden Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.7.zip Version: 1.4.7 Tested o...

lalestoncarandvan.co.uk Cross Site Scripting vulnerability OBB-1229553

Following coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: &nbsp&nbsp&nbsp&nbsp&nbsp&nbspa. verified the vulnerability and confirmed its existence; &nbsp&nbsp&nbsp&nbsp&nbsp&nbspb. notified the website operator about its existence...