CVE-2018-11633

The CVE-2018-11633 issue affects the MULTIDOTS Woo Checkout for Digital Goods plugin for WordPress (version 2.1). The vulnerability stems from the function woo_checkout_settings_page in class-woo-checkout-for-digital-goods-admin.php not validating CSRF against wp-admin/admin-post.php and lacking ...

CVE-2018-11579

class-woo-banner-management.php in the MULTIDOTS WooCommerce Category Banner Management plugin 1.1.0 for WordPress has an Unauthenticated Settings Change Vulnerability, related to certain wpajaxnopriv usage. Anyone can change the plugin's setting by simply sending a request with a...

WordPress Woo Import Export 1.0 - Arbitrary File Deletion vulnerability

Arbitrary File Deletion vulnerability found by Lenon Leite in WordPress Woo Import Export version 1.0. Solution This plugin was closed on 26th January 2018 and is no longer available for download. Reason: Security Issue. Deactivate and uninstall...

WordPress Woo Import Export 1.0 Arbitrary File Deletion

...

WordPress Woo Import Export 1.0 Plugin - Arbitrary File Deletion Vulnerability

Exploit for php platform in category web applications 0day.today 2018-04-26...

WordPress Plugin Woo Import Export 1.0 - Arbitrary File Deletion

WordPress Plugin Woo Import Export 1.0 - Arbitrary File Deletion...

WordPress Plugin Woo Import Export 1.0 - Arbitrary File Deletion

...

Woo Custom Checkout Field <= 1.3.4 - CSRF & Stored XSS

Due to a lack of CSRF mitigation and entity encoding in the ccfinsert function found on line 118 of include/ccf.php and in the output generated by template/datagrid.php, it is possible to store and execute scripts in the context of an admin user. PoC...

Woo Custom Checkout Field <= 1.3.4 - CSRF & Stored XSS

Due to a lack of CSRF mitigation and entity encoding in the ccfinsert function found on line 118 of include/ccf.php and in the output generated by template/datagrid.php, it is possible to store and execute scripts in the context of an admin user...

Woo Email Control <= 1.01 - Reflected Cross-Site Scripting (XSS) & CSRF

Due to a lack of encoding and CSRF mitigation in the testemail function found on line 106 of classes/class-wooctrl.php, it is possible to automate a request to the AJAX handler for the wooctrlsendtestemail action which will reflect the specified script back to the end user. PoC...

Unfixed XSS vulnerability at www.hupo.tv

Security researcher Woo, has submitted on 09/04/2009 a cross-site-scripting XSS vulnerability affecting www.hupo.tv, which at the time of submission ranked 40792 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 30/10/2010. It is currently unfixe...

Unfixed XSS vulnerability at channel.patzzi.joins.com

Security researcher Woo, has submitted on 30/03/2009 a cross-site-scripting XSS vulnerability affecting channel.patzzi.joins.com, which at the time of submission ranked 6440 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/11/2011. It is...

Unfixed XSS vulnerability at news.onekoreanews.net

Security researcher Woo, has submitted on 28/03/2009 a cross-site-scripting XSS vulnerability affecting news.onekoreanews.net, which at the time of submission ranked 4643704 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/12/2011. It is...

Unfixed XSS vulnerability at poke.ula.cc

Security researcher Woo, has submitted on 28/03/2009 a cross-site-scripting XSS vulnerability affecting poke.ula.cc, which at the time of submission ranked 15078 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/07/2009. It is currently unfixe...

Unfixed XSS vulnerability at news.onekoreanews.net

Security researcher Woo, has submitted on 28/03/2009 a cross-site-scripting XSS vulnerability affecting news.onekoreanews.net, which at the time of submission ranked 4643704 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/12/2011. It is...

Unfixed XSS vulnerability at www.mknews.jp

Security researcher Woo, has submitted on 27/03/2009 a cross-site-scripting XSS vulnerability affecting www.mknews.jp, which at the time of submission ranked 8194153 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 07/11/2011. It is currently...

Unfixed XSS vulnerability at www.nikkanberita.com

Security researcher Woo, has submitted on 27/03/2009 a cross-site-scripting XSS vulnerability affecting www.nikkanberita.com, which at the time of submission ranked 498293 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 27/05/2009. It is...

Unfixed XSS vulnerability at www.backchina.com

Security researcher Woo, has submitted on 27/03/2009 a cross-site-scripting XSS vulnerability affecting www.backchina.com, which at the time of submission ranked 8301 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 01/07/2009. It is currently...

Unfixed XSS vulnerability at idol.mp3torrent.org

Security researcher Woo, has submitted on 01/04/2009 a cross-site-scripting XSS vulnerability affecting idol.mp3torrent.org, which at the time of submission ranked 0 on the web according to Alexa. We manually validated and published a mirror of this vulnerability on 21/11/2011. It is currently...

wmp-dos.txt

/ Windows Media Player AIFF Divide By Zero Exception DOS POC by Hong Gil-Dong, Jeon Woo-chi Jeong Ji-Sang ?¡­1135, He was one of the most famous korean poet. This poem says sadness about good-bye'. áêìÑ éëúÎíþð§õ®ßäÒý áêÏÖÑõøÝÔÑÝèÊ° ÓÞÔÒË°â©ù¼ãÁò× Ü¬×¨Ò´Ò´ôÕÖà÷î If you open the kr.aiff in Window...