354 matches found
Cross site request forgery (csrf)
The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make...
CVE-2021-24806
CVE-2021-24806 documents a CSRF vulnerability in the WordPress plugin wpDiscuz, affecting versions before 7.3.4. The flaw is a CSRF check failure for adding, editing, and deleting comments, enabling an attacker to cause logged-in users (including admins or the comment author) to edit/delete arbit...
CVE-2021-24806 wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF
The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make...
WordPress 插件跨站请求伪造漏洞
WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. cross-site request forgery vulnerability exists in...
WordPress wpDiscuz plugin cross-site scripting vulnerability
WordPress plugin is a WordPress application plugin. WordPress wpDiscuz plugin 7.3.0 and prior versions contain a cross-site scripting vulnerability that stems from the plugin's failure to properly clean up or escape Follow and Unfollow messages before outputting them to the page. An attacker coul...
CVE-2021-24737
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...
Cross site scripting
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...
CVE-2021-24737
CVE-2021-24737 affects the WordPress wpDiscuz plugin up to v7.3.0. It fails to sanitize/escape Follow and Unfollow messages, enabling Stored XSS by high-privilege users even when unfiltered_html is disallowed. Exploitation vectors are via output on pages and documented PoCs exist in multiple sour...
CVE-2021-24737 Comments - wpDiscuz <= 7.3.0 - Admin+ Stored Cross-Site Scripting
The Comments – wpDiscuz WordPress plugin through 7.3.0 does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is...
WordPress 插件 跨站脚本漏洞
WordPress plugin is a WordPress application plugin. WordPress wpDiscuz plugin 7.3.0 and prior versions contain a cross-site scripting vulnerability that stems from the plugin's failure to properly clean up or escape Follow and Unfollow messages before outputting them to the page. An attacker coul...
WordPress wpDiscuz plugin <= 7.3.3 - Cross-Site Request Forgery (CSRF) vulnerability leading to Arbitrary Comment Addition/Edition/Deletion
Cross-Site Request Forgery CSRF vulnerability leading to Arbitrary Comment Addition/Edition/Deletion discovered by Brandon Roldan in WordPress wpDiscuz plugin versions = 7.3.3. Solution Update the WordPress wpDiscuz plugin to the latest available version at least 7.3.4...
wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF
The plugin does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary...
wpDiscuz < 7.3.4 - Arbitrary Comment Addition/Edition/Deletion via CSRF
The plugin does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary comment, or the user who made the comment to edit it via a CSRF attack. Attackers could also make logged in users post arbitrary...
Comments - wpDiscuz < 7.3.2 - Admin+ Stored Cross-Site Scripting
The plugin does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Timeline: May 18th, 2021 - Vendor...
WordPress wpDiscuz plugin <= 7.3.1 - Stored Cross-Site Scripting (XSS) vulnerability
Stored Cross-Site Scripting XSS vulnerability discovered by Phu Tran in WordPress wpDiscuz plugin versions = 7.3.1. Solution Update the WordPress wpDiscuz plugin to the latest available version at least 7.3.2...
Comments - wpDiscuz < 7.3.2 - Admin+ Stored Cross-Site Scripting
The plugin does not properly sanitise or escape the Follow and Unfollow messages before outputting them in the page, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed. Timeline: May 18th, 2021 - Vendor...
WordPress wpDiscuz 7.0.4 Shell Upload Exploit
This Metasploit module exploits an arbitrary file upload in the WordPress wpDiscuz plugin versions from 7.0.0 through 7.0.4. This flaw gave unauthenticated attackers the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable server. This module...
WordPress wpDiscuz 7.0.4 Shell Upload
This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress wpDiscuz Unauthenticated File Upload Vulnerability', 'Description' = %q This module exploits an arbitrary file upload in the WordPress...
WordPress wpDiscuz Unauthenticated File Upload Vulnerability
This module exploits an arbitrary file upload in the WordPress wpDiscuz plugin versions = 7.0.0 and use exploit/unix/webapp/wpwpdiscuzunauthenticatedfileupload msf exploitwpwpdiscuzunauthenticatedfileupload show targets ...targets... msf exploitwpwpdiscuzunauthenticatedfileupload set TARGET msf...
