Archive
13 December 2021
Vulnerabilities first published on this day (UTC), newest first.
108 results · Feed
-
Unscored —
Page/Post Content Shortcode <= 1.0 - Contributor+ Arbitrary Posts/Pages Access
The Page/Post Content Shortcode WordPress plugin through 1.0 does not have proper authorisation in place, allowing users with a role as low as contributor to access draft/private/password protected/trashed posts/pages they should not be allowed to, including …
-
Unscored —
WP Limits <= 1.0 - Plugin's Settings Update via CSRF
The WP Limits WordPress plugin through 1.0 does not have CSRF check when saving its settings, allowing attacker to make a logged in admin change them, which could make the blog unstable by setting low values
-
Unscored —
Ultimate NoFollow <= 1.4.8 - Contributor+ Stored Cross-Site Scripting
The Ultimate NoFollow WordPress plugin through 1.4.8 does not sanitise and escape the href attribute of its shortcodes, allowing users with a role as low as contributor to perform Cross-Site Scripting attacks
-
Unscored —
Filter Portfolio Gallery <= 1.5 - Arbitrary Gallery Deletion via CSRF
The Filter Portfolio Gallery WordPress plugin through 1.5 is lacking Cross-Site Request Forgery (CSRF) check when deleting a Gallery, which could allow attackers to make a logged in admin delete arbitrary Gallery.
-
Unscored —
Shiny Buttons <= 1.1.0 - Unauthenticated Stored Cross-Site Scripting
The Shiny Buttons WordPress plugin through 1.1.0 does not have any authorisation and CSRF in place when saving a template (wpbtn_save_template function hooked to the init action), nor sanitise and escape them before outputting them in the admin dashboard, whi…
-
Unscored —
Contact Form Advanced Database <= 1.0.8 - Unauthorised AJAX Calls
The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low …
-
Unscored —
WP Admin Logo Changer <= 1.0 - Plugin's Settings Update via CSRF
The WP Admin Logo Changer WordPress plugin through 1.0 does not have CSRF check when saving its settings, which could allow attackers to make a logged in admin update them via a CSRF attack.
-
Unscored —
Flex Local Fonts <= 1.0.0 - Admin+ Stored Cross-Site-Scripting
The Flex Local Fonts WordPress plugin through 1.0.0 does not escape the Class Name field when adding a font, which could allow hight privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Unscored —
Single Post Exporter <= 1.1.1 - Plugin's Settings Update via CSRF
The Single Post Exporter WordPress plugin through 1.1.1 does not have CSRF checks when saving its settings, which could allow attackers to make a logged in admin change them via a CSRF attack and give access to the export feature to any role such as subscribe…
-
Unscored —
Inspirational Quote Rotator <= 1.0.0 - Admin+ Stored Cross-Site Scripting
The Inspirational Quote Rotator WordPress plugin through 1.0.0 does not sanitize and escape some of its quote fields when adding/editing a quote as admin, leading to Stored Cross-Site scripting issues when the quote is output in the "Quotes list" even when th…
-
Unscored —
WP System Log < 1.0.21 - Unauthenticated Stored Cross-Site Scripting
The WP System Log WordPress plugin before 1.0.21 does not sanitise, validate and escape the IP address retrieved from login requests before outputting them in the admin dashboard, which could allow unauthenticated attacker to perform Cross-Site Scripting atta…
-
Unscored —
SEO Booster < 3.8 - Admin+ SQL Injection
The SEO Booster WordPress plugin before 3.8 allows for authenticated SQL injection via the "fn_my_ajaxified_dataloader_ajax" AJAX request as the $_REQUEST['order'][0]['dir'] parameter is not properly escaped leading to blind and error-based SQL injections.
-
Unscored —
NEX-Forms < 8.4.3 - Stored Cross-Site Scripting via CSRF
The NEX-Forms WordPress plugin before 8.4.3 does not have CSRF checks in place when editing a form, and does not escape some of its settings as well as form fields before outputting them in attributes. This could allow attackers to make a logged in admin edit…
-
Unscored —
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing a…
-
Unscored —
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing a…
-
Unscored —
Advanced Custom Fields versions prior to 5.11 and Advanced Custom Fields Pro versions prior to 5.11 contain a missing a…
-
Unscored —
An issue was discovered in Reprise RLM 14.2. By using an admin account, an attacker can write a payload to /goform/edit…
-
Unscored —
An issue was discovered in Reprise RLM 14.2. When editing the license file, it is possible for an admin user to enable …
-
Unscored —
Auerswald COMpact 5500R devices before 8.2B allow Arbitrary File Disclosure. A sub-admin can read the cleartext Admin p…
-
Unscored —
Auerswald COMpact 5500R devices before 8.2B allow Privilege Escalation via the passwd=1 substring.
-
Unscored —
Auerswald COMfortel 1400 IP and 2600 IP before 2.8G devices allow Authentication Bypass via the /about/../ substring.
-
Unscored —
In Cibele Thinfinity VirtualUI before 3.0, /changePassword returns different responses for invalid authentication reque…
-
Unscored —
The TCP Server module in toxcore before 0.2.8 doesn't free the TCP priority queue under certain conditions, which allow…
-
Unscored —
A stack-based buffer overflow in handle_request function in DHT.c in toxcore 0.1.9 through 0.1.11 and 0.2.0 through 0.2…
-
Unscored —
The Onion module in toxcore before 0.2.2 doesn't restrict which packets can be onion-routed, which allows a remote atta…
-
Unscored —
An issue was discovered in Reprise RLM 14.2. As the session cookies are small, an attacker can hijack any existing sess…
-
Unscored —
An issue was discovered in Reprise RLM 14.2. Because /goform/change_password_process does not verify authentication or …
-
Unscored —
An issue was discovered in /goform/login_process in Reprise RLM 14.2. When an attacker attempts to login, the response …