CVSS: 6.4EPSS: 2%CPEs: 4EXPL: 1CVE-2019-16222 – WordPress Core < 5.2.3 - Stored Cross-Site Scripting via Comments via URLs
https://notcve.org/view.php?id=CVE-2019-16222
05 Sep 2019 — WordPress before 5.2.3 has an issue with URL sanitization in wp_kses_bad_protocol_once in wp-includes/kses.php that can lead to cross-site scripting (XSS) attacks. WordPress versiones anteriores a 5.2.3, presenta un problema con el saneamiento de la URL en la función wp_kses_bad_protocol_once en el archivo wp-includes/kses.php, lo que puede conllevar a ataques de tipo cross-site scripting (XSS). Several vulnerabilities were discovered in Wordpress, a web blogging tool. They allowed remote attackers to perfo... • https://core.trac.wordpress.org/changeset/45997 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 1%CPEs: 7EXPL: 0CVE-2018-19296 – Ubuntu Security Notice USN-5956-2
https://notcve.org/view.php?id=CVE-2018-19296
16 Nov 2018 — PHPMailer before 5.2.27 and 6.x before 6.0.6 is vulnerable to an object injection attack. PHPMailer en versiones anteriores a la 5.2.27 y versiones 6.x anteriores a la 6.0.6 es vulnerable a un ataque de inyección de objetos. Dawid Golunski discovered that PHPMailer was not properly escaping user input data used as arguments to functions executed by the system shell. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 16.04 ESM. • https://github.com/PHPMailer/PHPMailer/releases/tag/v5.2.27 • CWE-502: Deserialization of Untrusted Data CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution') •