CVE-2023-37979
HIGH NUCLEINinja Forms < 3.6.26 - Unauthenticated Reflected Cross-Site Scripting
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2023-37979. PoCs published by Mehran Seifalinia, Mehran-Seifalinia, d0rb. A Nuclei detection template is also available.
AI-analyzed exploit summary This exploit demonstrates a reflected XSS vulnerability in WordPress Ninja Forms plugin version 3.6.25. It generates an HTML page that, when interacted with, triggers an XSS payload via a crafted form submission to the vulnerable endpoint.
Description
Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions.
Exploits (4)
This exploit demonstrates a reflected XSS vulnerability in WordPress Ninja Forms plugin version 3.6.25. It generates an HTML page that, when interacted with, triggers an XSS payload via a crafted form submission to the vulnerable endpoint.
This repository contains a functional Python script and Nuclei template for exploiting CVE-2023-37979, a reflected XSS vulnerability in Ninja Forms WordPress plugin versions up to 3.6.25. The script generates an HTML PoC file that triggers the XSS payload when interacted with by an authenticated user.
The repository contains a functional Python script that exploits CVE-2023-37979, a reflected XSS vulnerability in Ninja Forms WordPress plugin versions up to 3.6.25. The script generates an HTML PoC file that triggers the XSS via a crafted 'data' parameter in a POST request to the vulnerable endpoint.
This repository contains a functional exploit for CVE-2023-37979, an unauthenticated reflected XSS vulnerability in the Ninja Forms Contact Form plugin (versions <= 3.6.25). The exploit sends a crafted payload to the vulnerable endpoint and checks for the presence of the plugin and its version.
Nuclei Templates (1)
http.html:/wp-content/plugins/ninja-forms/
body=/wp-content/plugins/ninja-forms/
References (3)
Scores
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L