Archive
28 March 2022
Vulnerabilities first published on this day (UTC), newest first.
113 results · Feed
-
Medium 4.3
An issue has been discovered in GitLab CE/EE affecting all versions starting from 11.4 before 14.5.4, all versions star…
-
Medium 6.5
An issue has been discovered in GitLab CE/EE affecting all versions before 14.3.6, all versions starting from 14.4 befo…
-
Critical 10.0
An issue has been discovered in GitLab CE/EE affecting all versions starting from 12.10 before 14.6.5, all versions sta…
-
Unscored —
Under certain conditions, SAP Innovation management - version 2.0, allows an attacker to access information which could…
-
Low 3.3
Mirmay Secure Private Browser / File Manager Auto Lock improper authentication
A vulnerability classified as problematic has been found in Mirmay Secure Private Browser and File Manager up to 2.5. Affected is the Auto Lock. A race condition leads to a local authentication bypass. The exploit has been disclosed to the public and may be u…
-
Medium 6.1
Cross-site Scripting in teampass
Teampass 2.1.26 allows reflected XSS via the index.php PATH_INFO.
-
Medium 5.3
Kiddoware Kids Place Home Button Protection denial of service
A vulnerability classified as problematic has been found in Kiddoware Kids Place. This affects the Home Button Protection. A repeated pressing of the button causes a local denial of service. It is recommended to upgrade the affected component.
-
Unscored —CVE-2022-0846 Scanner template
SpeakOut! Email Petitions < 2.14.15.1 - Unauthenticated SQLi
The SpeakOut! Email Petitions WordPress plugin before 2.14.15.1 does not sanitise and escape the id parameter before using it in a SQL statement via the dk_speakout_sendmail AJAX action, leading to an SQL Injection exploitable by unauthenticated users
-
Unscored —
Church Admin < 3.4.135 - Unauthenticated Plugin's Backup Disclosure
The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a …
-
Unscored —
Coupon Affiliates < 4.16.4.5 - Unauthenticated Stored XSS
The WooCommerce Affiliate Plugin WordPress plugin before 4.16.4.5 does not have authorization and CSRF checks on a specific action handler, as well as does not sanitize its settings, which enables an unauthenticated attacker to inject malicious XSS payloads i…
-
Unscored —CVE-2022-0787 Scanner template
Limit Login Attempts (Spam Protection) < 5.1 - Unauthenticated SQLi
The Limit Login Attempts (Spam Protection) WordPress plugin before 5.1 does not sanitise and escape some parameters before using them in SQL statements via AJAX actions (available to unauthenticated users), leading to SQL Injections
-
Unscored —
Title Experiments Free < 9.0.1 - Unauthenticated SQLi
The Title Experiments Free WordPress plugin before 9.0.1 does not sanitise and escape the id parameter before using it in a SQL statement via the wpex_titles AJAX action (available to unauthenticated users), leading to an unauthenticated SQL injection
-
Unscored —
Translate WordPress with GTranslate < 2.9.9 - CSRF to Account Takeover
The Translate WordPress with GTranslate WordPress plugin before 2.9.9 does not have CSRF check in some files, and write debug data such as user's cookies in a publicly accessible file if a specific parameter is used when requesting them. Combining those two i…
-
Unscored —
Amelia < 1.0.47 - Customer+ Arbitrary Appointments Update and Sensitive Data Disclosure
The Amelia WordPress plugin before 1.0.47 does not have proper authorisation when managing appointments, allowing any customer to update other's booking, as well as retrieve sensitive information about the bookings, such as the full name and phone number of t…
-
Unscored —
Plezi < 1.0.3 - Unauthenticated Stored XSS
The Plezi WordPress plugin before 1.0.3 has a REST endpoint allowing unauthenticated users to update the plz_configuration_tracker_enable option, which is then displayed in the admin panel without sanitisation and escaping, leading to a Stored Cross-Site Scri…
-
Unscored —
Narnoo Distributor <= 2.5.1 - Unauthenticated LFI to Arbitrary File Read / RCE
The Narnoo Distributor WordPress plugin through 2.5.1 fails to validate and sanitize the lib_path parameter before it is passed into a call to require() via the narnoo_distributor_lib_request AJAX action (available to both unauthenticated and authenticated us…
-
Unscored —
Bulk Creator <= 1.0.1 - Reflected Cross-Site Scripting
The Bulk Creator WordPress plugin through 1.0.1 does not sanitize and escape the post_type parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
-
Unscored —
Bank Mellat <= 1.3.7 - Reflected Cross-Site Scripting
The Bank Mellat WordPress plugin through 1.3.7 does not sanitize and escape the orderId parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
-
Unscored —
Popup Like box < 3.6.1 - Reflected Cross-Site Scripting
The Popup Like box WordPress plugin before 3.6.1 does not sanitize and escape the ays_fb_tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
-
Unscored —
dTabs <= 1.4 - Reflected Cross-Site Scripting
The dTabs WordPress plugin through 1.4 does not sanitize and escape the tab parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
-
Unscored —
Delete Old Orders <= 0.2 - Reflected Cross-Site Scripting
The Delete Old Orders WordPress plugin through 0.2 does not sanitize and escape the date parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
-
Unscored —
Database Peek <= 1.2 - Reflected Cross-Site Scripting
The Database Peek WordPress plugin through 1.2 does not sanitize and escape the match parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
-
Unscored —
Conference Scheduler < 2.4.3 - Reflected Cross-Site Scripting
The Conference Scheduler WordPress plugin before 2.4.3 does not sanitize and escape the tab parameter before outputting back in an admin page, leading to a Reflected Cross-Site Scripting.
-
Unscored —CVE-2022-0599 Scanner template
Mapping Multiple URLs Redirect Same Page <= 5.8 - Reflected Cross-Site Scripting
The Mapping Multiple URLs Redirect Same Page WordPress plugin through 5.8 does not sanitize and escape the mmursp_id parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting.
-
Unscored —
Drag and Drop Multiple File Upload - Contact Form 7 < 1.3.6.3 - Unauthenticated Stored XSS
The Drag and Drop Multiple File Upload WordPress plugin before 1.3.6.3 allows SVG files to be uploaded by default via the dnd_codedropz_upload AJAX action, which could lead to Stored Cross-Site Scripting issue
-
Unscored —
Sermon Browser <= 0.45.22 - Arbitrary File Upload via CSRF
The Sermon Browser WordPress plugin through 0.45.22 does not have CSRF checks in place when uploading Sermon files, and does not validate them in any way, allowing attackers to make a logged in admin upload arbitrary files such as PHP ones.
-
Unscored —
String Locator < 2.5.0 - Admin+ Arbitrary File Read
The String locator WordPress plugin before 2.5.0 does not properly validate the path of the files to be searched, allowing high privilege users such as admin to query arbitrary files on the web server via a path traversal vector. Furthermore, due to a flaw in…
-
Unscored —
Popup Builder < 4.1.1 - SQL Injection to Reflected Cross-Site Scripting
The Popup Builder WordPress plugin before 4.1.1 does not sanitise and escape the sgpb-subscription-popup-id parameter before using it in a SQL statement in the All Subscribers admin dashboard, leading to a SQL injection, which could also be used to perform Re…
-
Unscored —
Menu Image, Icons made easy < 3.0.8 - Subscriber+ Stored Cross-Site Scripting
The Menu Image, Icons made easy WordPress plugin before 3.0.6 does not have authorisation and CSRF checks when saving menu settings, and does not validate, sanitise and escape them. As a result, any authenticate users, such as subscriber can update the settin…
-
Unscored —
WPC Smart Wishlist for WooCommerce < 2.9.4 - Reflected Cross-Site Scripting
The WPC Smart Wishlist for WooCommerce WordPress plugin before 2.9.4 does not sanitise and escape the key parameter before outputting it back in the wishlist_quickview AJAX action's response (available to any authenticated user), leading to a Reflected Cross-…
-
Unscored —
Interactive Medical Drawing of Human Body < 2.6 - Admin+ Stored XSS
The Interactive Medical Drawing of Human Body WordPress plugin before 2.6 does not sanitise and escape the Link field, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Unscored —
Akismet Privacy Policies <= 2.0.1 - Reflected Cross-Site Scripting
The WordPress plugin through 2.0.1 does not sanitise and escape the translation parameter before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting
-
Unscored —
WP Block and Stop Bad Bots < 6.88 - Unauthenticated SQLi
The Block Bad Bots WordPress plugin before 6.88 does not properly sanitise and escape the User Agent before using it in a SQL statement to record logs, leading to an SQL Injection issue
-
Unscored —
Sync WooCommerce Product feed to Google Shopping <= 1.2.4 - Admin+ SQLi
The Sync WooCommerce Product feed to Google Shopping WordPress plugin through 1.2.4 uses the 'feed_id' POST parameter which is not properly sanitized for use in a SQL statement, leading to a SQL injection vulnerability in the admin dashboard
-
Unscored —
Wow Countdowns <= 3.1.2 - Admin+ SQLi
The Wow Countdowns WordPress plugin through 3.1.2 does not sanitize user input into the 'did' parameter and uses it in a SQL statement, leading to an authenticated SQL Injection.
-
Unscored —
Pz-LinkCard <= 2.4.4.4 - Reflected Cross-Site Scripting
The Pz-LinkCard WordPress plugin through 2.4.4.4 does not sanitise and escape multiple parameters before outputting them back in admin dashboard pages, leading to Reflected Cross-Site Scripting issues
-
Unscored —
OSMapper <= 2.1.5 - Unauthenticated Arbitrary Post Deletion
The OSMapper WordPress plugin through 2.1.5 contains an AJAX action to delete a plugin related post type named 'map' and is registered with the wp_ajax_nopriv prefix, making it available to unauthenticated users. There is no authorisation, CSRF and checks in …
-
Unscored —
WordPress File Upload < 4.16.3 - Contributor+ Path Traversal to RCE
The WordPress File Upload Free and Pro WordPress plugins before 4.16.3 allow users with a role as low as Contributor to perform path traversal via a shortcode argument, which can then be used to upload a PHP code disguised as an image inside the auto-loaded d…
-
Unscored —CVE-2021-24746 Scanner template
Sassy Social Share < 3.3.40 - Reflected Cross-Site Scripting
The Social Sharing Plugin WordPress plugin before 3.3.40 does not escape the viewed post URL before outputting it back in onclick attributes when the "Enable 'More' icon" option is enabled (which is the default setting), leading to a Reflected Cross-Site Scri…
-
Medium 5.5
A CWE-611: Improper Restriction of XML External Entity Reference vulnerability exists that could result in information …