Lucene search
Gerard ArallWPVDB-ID:19C1F9C0-E30E-4A9C-8A0C-FBE3384D734AHistoryApr 01, 2016 - 12:00 a.m.
Cerber Limit Login Attempts <= 2.0.1.6 - Unauthenticated Stored XSS
2016-04-0100:00:00
Gerard Arall
wpscan.com
13
EPSS
0.001
Percentile
40.7%
If the option “I’m behind a proxy” is enabled, the visitor IP is read from X-Forwarded-For header, stored & printed in the admin panel without any sanitization / validation.
PoC
Set the X-Forwarded-For header to , and perform an incorrect login.
Related
cve
cve
CVE-2016-10990
2019-09-17 15:15:12
cvelist
cvelist
CVE-2016-10990
2019-09-17 14:30:32
nvd
nvd
CVE-2016-10990
2019-09-17 15:15:12
prion
prion
Design/Logic Flaw
2019-09-17 15:15:00
wpexploit
wpexploit
Cerber Limit Login Attempts <= 2.0.1.6 - Unauthenticated Stored XSS
2016-04-01 00:00:00