medium4.3Public exploit code
CVE-2014-9094
Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow re…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- WordPress Plugin DZS-VideoGallery - Cross-Site Scripting / Command Injection2014-07-13 · webapps · php · Verified
Impact
Multiple cross-site scripting (XSS) vulnerabilities in deploy/designer/preview.php in the Digital Zoom Studio (DZS) Video Gallery plugin for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) swfloc or (2) designrand parameter.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Digitalzoomstudio | Video Gallery | All versions |
Weakness classification
References
- NVD record
- CVE.org record
- http://seclists.org/fulldisclosure/2014/Jul/65
- http://websecurity.com.ua/7152/
- http://www.securityfocus.com/bid/108579
- http://www.securityfocus.com/bid/68525
- http://seclists.org/fulldisclosure/2014/Jul/65
- http://websecurity.com.ua/7152/
- http://www.securityfocus.com/bid/108579
- http://www.securityfocus.com/bid/68525