Uber: Reflected XSS and sensitive data exposure, including payment details, on lioncityrentals.com.sg

lioncityrentals.com.sg employed a Wordpress installation that possessed a vulnerable plugin, Formidable Forms, which was vulnerable to reflected XSS, and exposed sensitive form data. Thanks again for the report, @healdb! This was the first bug I ever found that exposed a large amount of PII, than...

WordPress responsive-coming-soon-page plugin cross-site scripting vulnerability (CNVD-2018-01257)

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL servers to set up a personal blog site . responsive-coming-soon-page plugin is used in one of the test system maintenance plugin . A cross-site scriptin...

WordPress Advanced Post Type Ratings 1.1 Cross Site Scripting

Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Advanced Post Type Ratings Plugin 1.1 DFD Reddcoin Tips Plugin is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may leverage this issue to...

WordPress Sites Exposed by Vulnerable Plugin SQL Injection Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress Sites Exposed by Vulnerable plugin, which allows attackers to exploit t...

Million-Plus WordPress Sites Exposed by Vulnerable Plugin

A popular WordPress gallery plugin with more than one million active installations was recently patched to address a vulnerability exposing website databases to attack. The NextGEN Gallery is a photo gallery management system used by professional photographers and artists upload, sort and group...

Automattic: Open Redirect in WordPress Feed Statistics {Affected All Versions}

Hi, Feed Statistics Plugin is vulnerable to Open Redirect and effecting large amount of Websites. Which is the reason it should be patched swiftly. Detail description is given below: Tested on: Wordpress 3.9.1 Vulnerable Plugin: Feed Statistics Plugin Link:...

WordPress Plugin Google Document Embedder Arbitrary File Disclosure

No description provided by source. This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit web site for more information on licensing and terms of use. http://metasploit.com/ require 'msf/core' require 'rbmysql' cla...

Notepad++ NppFTP plugin LIST command Remote Heap Overflow PoC

No description provided by source. Notepad++ NppFTP plugin LIST command Remote Heap Overflow PoC Date: 17.08.2011 Author: 0in Maksymilian Motyl Mail: 0in dot email /at\ gmail \dot/ com Software Link: http://notepad-plus-plus.org/ Vulnerable plugin: http://sourceforge.net/projects/nppftp/ Version:...

Ultimate Weather Plugin <= 1.0 - Unauthenticated Reflected XSS

The last time it was checked the plugin was still affected and had been closed. http://www.example.com/wp-content/plugins/ultimate–weather–plugin/magpierss/scripts/magpiedebug.php?url=%22%3E%3Cscript%3Ealert%281%29%3C%2Fscript%3E...

MyBB Profile Wii Friend Code - Multiple Vulnerabilities

MyBB Profile Wii Friend Code - Multiple Vulnerabilities Exploit Title: MyBB Profile Wii Friend Code SQLi/Persistent XSS Dork: intitle:"Profile of" intext:"Wii Friend Code" inurl:member.php Date: 1/3/2013 Exploit Author: Ichi Vendor Homepage: http://mods.mybb.com/view/profile-wii-friend-code...

WordPress Plugin Contus Video Gallery - 'upload1.php' Arbitrary File Upload

source: https://www.securityfocus.com/bid/53931/info WordPress Contus Video Gallery is prone to a vulnerability that lets attackers upload arbitrary files. The issue occurs because the application fails to adequately sanitize user-supplied input. An attacker may leverage this issue to upload...

WordPress Hungred Post Thumbnail 2.1.9 Shell Upload

Description : Wordpress Plugins - Hungred Post Thumbnail Arbitrary File Upload Vulnerability Version : 2.1.9 Link : http://wordpress.org/extend/plugins/hungred-post-thumbnail/ Plugins : http://downloads.wordpress.org/plugin/hungred-post-thumbnail.zip Date : 31-05-2012 Google Dork :...

Echo Security Advisory 2007.64

------------------------------------------------------------------------------------ ECHOADV64$2007 Openi CMS plugins site protection remote file inclusion ------------------------------------------------------------------------------------ Author : Ahmad Muammar W.K a.k.a y3dips Date Found :...