# php

CVE-2022-4213: Vulnerability Advisories Continued - Wordfence

#git #php

The Chained Quiz plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'dn' parameter on the 'chainedquiz_list' page in versions up to, and including, 1.3.2.2 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link.

2 years ago

CVE-2022-4220: WP plugin Chained Quiz multiple vulnerabilities

#xss #vulnerability #web #java #wordpress #php #backdoor #rce #perl #ssrf #auth

The Chained Quiz plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.3.2.4. This is due to missing nonce validation on the list_questions() function. This makes it possible for unauthenticated attackers to delete questions from quizzes via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.

2 years ago

#xss #csrf #vulnerability #web #wordpress #php #auth

CVE-2022-44962

webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /calendar/viewcalendar.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Subject field.

2 years ago

CVE-2022-44961: Stored Cross Site Scripting Vulnerability Bypass filter on "Forums" feature in webtareas 2.4p5 · Issue #7 · anhdq201/webtareas

#xss #vulnerability #web #php

webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /forums/editforum.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

2 years ago

CVE-2022-44954: Stored Cross Site Scripting Vulnerability Bypass filter on "Contacts" feature in webtareas 2.4p5 · Issue #10 · anhdq201/webtareas

webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /contacts/listcontacts.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Last Name field after clicking "Add".

2 years ago

CVE-2022-44953: Stored Cross Site Scripting Vulnerability Bypass filter on "Files" feature in webtareas 2.4p5 · Issue #8 · anhdq201/webtareas

webtareas 2.4p5 was discovered to contain a cross-site scripting (XSS) vulnerability in the component /linkedcontent/listfiles.php. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field after clicking "Add".

2 years ago

CVE-2022-44952: Stored Cross Site Scripting Vulnerability on "Application Settings" in rukovoditel 3.2.1 · Issue #9 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in /index.php?module=configuration/application. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Copyright Text field after clicking "Add".

2 years ago

CVE-2022-44951: Stored Cross Site Scripting Vulnerability on "Form Configuration" in rukovoditel 3.2.1 · Issue #11 · anhdq201/rukovoditel

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Form tab function at /index.php?module=entities/forms&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

2 years ago

CVE-2022-44950

Rukovoditel v3.2.1 was discovered to contain a stored cross-site scripting (XSS) vulnerability in the Add New Field function at /index.php?module=entities/fields&entities_id=24. This vulnerability allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Name field.

2 years ago