Archive
14 February 2022
Vulnerabilities first published on this day (UTC), newest first.
69 results · Feed
-
Unscored —
Emerson Dixell XWEB-500 products are affected by information disclosure via directory listing. A potential attacker can…
-
Unscored —
Popup | Custom Popup Builder < 1.3.1 - Unauthenticated Denial of Service
The Custom Popup Builder WordPress plugin before 1.3.1 autoload data from its popup on every pages, as such data can be sent by unauthenticated user, and is not validated in length, this could cause a denial of service on the blog
-
Unscored —CVE-2022-0212 Scanner template
SpiderCalendar <= 1.5.65 - Reflected Cross-Site Scripting
The SpiderCalendar WordPress plugin through 1.5.65 does not sanitise and escape the callback parameter before outputting it back in the page via the window AJAX action (available to both unauthenticated and authenticated users), leading to a Reflected Cross-S…
-
Unscored —CVE-2022-0208 Scanner template
MapPress Maps for WordPress < 2.73.4 - Reflected Cross-Site scripting
The MapPress Maps for WordPress plugin before 2.73.4 does not sanitise and escape the mapid parameter before outputting it back in the "Bad mapid" error message, leading to a Reflected Cross-Site Scripting
-
Unscored —CVE-2022-0206 Scanner template
NewStatPress < 1.3.6 - Reflected Cross-Site Scripting
The NewStatPress WordPress plugin before 1.3.6 does not properly escape the whatX parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
-
Unscored —CVE-2022-0201 Scanner template
Permalink Manager < 2.2.15 - Reflected Cross-Site Scripting
The Permalink Manager Lite WordPress plugin before 2.2.15 and Permalink Manager Pro WordPress plugin before 2.2.15 do not sanitise and escape query parameters before outputting them back in the debug page, leading to a Reflected Cross-Site Scripting issue
-
Unscored —
Themify Portfolio Post < 1.1.7 - Reflected Cross-Site Scripting
Themify Portfolio Post WordPress plugin before 1.1.7 does not sanitise and escape the num_of_pages parameter before outputting it back the response of the themify_create_popup_page_pagination AJAX action (available to any authenticated user), leading to a Ref…
-
Unscored —
Complianz - GDPR/CCPA Cookie Consent < 6.0.0 - Reflected Cross-Site Scripting
The Complianz WordPress plugin before 6.0.0 does not escape the s parameter before outputting it back in an attribute in an admin page, leading to a Reflected Cross-Site Scripting
-
Unscored —
Ad Invalid Click Protector (AICP) < 1.2.6 - Authenticated SQL Injection
The Ad Invalid Click Protector (AICP) WordPress plugin before 1.2.6 is affected by a SQL Injection in the id parameter of the delete action.
-
Unscored —CVE-2022-0188 Scanner template
Coming Soon & Maintenance Plugin by NiteoThemes < 4.0.19 - Unauthenticated Arbitrary CSS Update
The CMP WordPress plugin before 4.0.19 allows any user, even not logged in, to arbitrarily change the coming soon page layout.
-
Unscored —
PowerPack Lite for Beaver Builder < 1.2.9.3 - Reflected Cross-Site Scripting
The PowerPack Lite for Beaver Builder WordPress plugin before 1.2.9.3 does not sanitise and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
-
Unscored —
WP Photo Album Plus < 8.0.10 - Stored Cross-Site Scripting (XSS)
The WP Photo Album Plus WordPress plugin before 8.0.10 was vulnerable to Stored Cross-Site Scripting (XSS). Error log content was handled improperly, therefore any user, even unauthenticated, could cause arbitrary javascript to be executed in the admin panel.
-
Unscored —
Futurio Extra < 1.6.3 - Subscriber+ User Email Address Disclosure
The Futurio Extra WordPress plugin before 1.6.3 allows any logged in user, such as subscriber, to extract any other user's email address.
-
Unscored —
Futurio Extra < 1.6.3 - Authenticated SQL Injection
The Futurio Extra WordPress plugin before 1.6.3 is affected by a SQL Injection vulnerability that could be used by high privilege users to extract data from the database as well as used to perform Cross-Site Scripting (XSS) against logged in admins by making …
-
Unscored —
Form Store to DB < 1.1.1 - Unauthenticated Stored Cross-Site Scripting
The Form Store to DB WordPress plugin before 1.1.1 does not sanitise and escape parameter keys before outputting it back in the created entry, allowing unauthenticated attacker to perform Cross-Site Scripting attacks against admin
-
Unscored —
Remove Footer Credit < 1.0.11 - Admin+ Stored Cross-Site Scripting
The Remove Footer Credit WordPress plugin before 1.0.11 does properly sanitise its settings, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html is disallowed.
-
Unscored —CVE-2021-25033 Scanner template
Noptin < 1.6.5 - Open Redirect
The WordPress Newsletter Plugin WordPress plugin before 1.6.5 does not validate the to parameter before redirecting the user to its given value, leading to an open redirect issue
-
Unscored —
PPOM for WooCommerce < 24.0 - Subscriber+ Settings Update to Stored XSS
The PPOM for WooCommerce WordPress plugin before 24.0 does not have authorisation and CSRF checks in the ppom_settings_panel_action AJAX action, allowing any authenticated to call it and set arbitrary settings. Furthermore, due to the lack of sanitisation and…
-
Unscored —
Ibtana < 1.1.4.9 - Subscriber+ Settings Update to Stored XSS
The Ibtana WordPress plugin before 1.1.4.9 does not have authorisation and CSRF checks in the ive_save_general_settings AJAX action, allowing any authenticated users, such as subscriber to call it and change the plugin's settings which could lead to Stored Cr…
-
Unscored —CVE-2021-24904 Public exploit
Mortgage Calculators WP < 1.56 - Admin+ Stored Cross-Site Scripting
The Mortgage Calculators WP WordPress plugin before 1.56 does not implement any sanitisation on the color setting of the background of a calculator, which could allow high privilege users to perform Stored Cross-Site Scripting attacks even when the unfiltered…
-
Unscored —
Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue < 3.1.31 - Reflected Cross-Site Scripting
The Newsletter, SMTP, Email marketing and Subscribe forms by Sendinblue WordPress plugin before 3.1.31 does not escape the lang and pid parameter before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues
-
Unscored —
Remove Footer Credit < 1.0.6 - CSRF to Stored Cross-Site Scripting
The Remove Footer Credit WordPress plugin before 1.0.6 does not have CSRF check in place when saving its settings, which could allow attacker to make logged in admins change them and lead to Stored XSS issue as well due to the lack of sanitisation
-
Unscored —
Kiteworks MFT 7.5 may allow an unauthorized user to reset other users' passwords. This is fixed in version 7.6 and late…
-
Medium 6.3
Crash in the CMS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packet…
-
High 8.8
Authorization Bypass Through User-Controlled Key in unshiftio/url-parse
Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.6.
-
Medium 6.3
Infinite loop in RTMPT protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via …
-
Medium 6.3
Unaligned access in the CSN.1 protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of servi…
-
Medium 6.3
Crash in the PVFS protocol dissector in Wireshark 3.6.0 to 3.6.1 and 3.4.0 to 3.4.11 allows denial of service via packe…
-
Unscored —
A Memory Leak vulnerability exists in SQLite Project SQLite3 3.35.1 and 3.37.0 via maliciously crafted SQL Queries (mad…