Archive
12 December 2022
Vulnerabilities first published on this day (UTC), newest first.
88 results · Feed
-
Medium —
Candy Machine Set Collection During Mint Missing Check
A problem with Candy Machine V2 allow minting NFTs to an arbitrary collection due to a missing check. Here is a description of the exploit: Details: Here is the tx/ix to exploit: Transaction: Ix 1: candy_machine v2, mint_nft, passing in empty metadata -1 Ix 2…
-
High —
Creator Verification Error when Bubblegum Activate
This was an error found by @metamania01 of the Audit Company Solshield. It allowed one to verify a creator that did not sign by making use of a provision in Token Metadata that allows Creators who have signed compressed nfts to allow them to decompress with v…
-
Medium 4.3
Due to a missing authentication check, SAP Business Objects Business Intelligence Platform (Web Intelligence) - version…
-
Medium 6.1
Due to insufficient input validation, SAP NetWeaver AS Java (HTTP Provider Service) - version 7.50, allows an unauthent…
-
Medium 6.0
SAP Solution Manager (Diagnostic Agent) - version 7.20, allows an authenticated attacker on Windows system to access a …
-
Medium 6.5
Booster for WooCommerce - Custom Role Creation/Deletion via CSRF
The Booster for WooCommerce WordPress plugin before 5.6.7, Booster Plus for WooCommerce WordPress plugin before 5.6.6, Booster Elite for WooCommerce WordPress plugin before 1.1.8 does not properly check for CSRF when creating and deleting Customer roles, allo…
-
Critical 9.8CVE-2022-3921 EPSS 21%
Listingo < 3.2.7 - Unauthenticated Arbitrary File Upload
The Listingo WordPress theme before 3.2.7 does not validate files to be uploaded via an AJAX action available to unauthenticated users, which could allow them to upload arbitrary files and lead to RCE
-
Critical 9.8CVE-2022-3900 EPSS 19%
Cooked Pro < 1.7.5.7 - Unauthenticated PHP Object Injection
The Cooked Pro WordPress plugin before 1.7.5.7 does not properly validate or sanitize the recipe_args parameter before unserializing it in the cooked_loadmore action, allowing an unauthenticated attacker to trigger a PHP Object injection vulnerability.
-
High 8.8
Motors - Car Dealer, Classifieds & Listing < 1.4.4 - Arbitrary File Upload
The Motors WordPress plugin before 1.4.4 does not properly validate uploaded files for dangerous file types (such as .php) in an AJAX action, allowing an attacker to sign up on a victim's WordPress instance, upload a malicious PHP file and attempt to launch a…
-
Medium 4.8
Livemesh Addons for Elementor < 7.2.4 - Admin+ Stored XSS
The Livemesh Addons for Elementor WordPress plugin before 7.2.4 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is …
-
Medium 4.8
WooCommerce Shipping - DPD baltic < 1.2.11 - Admin+ Stored XSS
The WooCommerce Shipping WordPress plugin through 1.2.11 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallo…
-
Medium 6.5
Welcart e-Commerce < 2.8.4 - Subscriber+ Arbitrary Shipping Method Creation/Update/Deletion
The Welcart e-Commerce WordPress plugin before 2.8.4 does not have authorisation and CSRF in an AJAX action, allowing any logged-in user to create, update and delete shipping methods.
-
Medium 5.7
WPTools < 3.43 - Subscriber+ Arbitrary Plugin Installation
The WP Tools Increase Maximum Limits, Repair, Server PHP Info, Javascript errors, File Permissions, Transients, Error Log WordPress plugin before 3.43 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as sub…
-
Medium 6.5
AntiHacker < 4.20 - Subscriber+ Arbitrary Plugin Installation
The Disable Json API, Login Lockdown, XMLRPC, Pingback, Stop User Enumeration Anti Hacker Scan WordPress plugin before 4.20 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and inst…
-
Medium 4.8
Easy Form Builder < 3.4.0 - Admin+ Stored XSS
The Easy Form Builder WordPress plugin before 3.4.0 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (…
-
Medium 6.5
Car Dealer < 3.05 - Subscriber+ Arbitrary Plugin Installation
The Car Dealer (Dealership) and Vehicle sales WordPress Plugin WordPress plugin before 3.05 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activate arbitrary plugi…
-
Medium 6.5
Directorist < 7.4.2.2 - Subscriber+ Arbitrary User Password Update via IDOR
The Directorist WordPress plugin before 7.4.2.2 suffers from an IDOR vulnerability which an attacker can exploit to change the password of arbitrary users instead of his own.
-
Medium 4.8
Image Hover Effects < 5.5 - Admin+ Stored XSS
The Image Hover Effects WordPress plugin before 5.5 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (…
-
High 8.1
WooCommerce Shipping - DPD baltic < 1.2.57 - Subscriber+ Arbitrary Options Deletion
The DPD Baltic Shipping WordPress plugin before 1.2.57 does not have authorisation and CSRF in an AJAX action, which could allow any authenticated users, such as subscriber to delete arbitrary options from the blog, which could make the blog unavailable.
-
Medium 4.8
GetYourGuide Ticketing < 1.0.4 - Admin+ Stored XSS
The GetYourGuide Ticketing WordPress plugin before 1.0.4 does not sanitise and escape some parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (…
-
Critical 9.8CVE-2022-3982 Scanner template
Booking Calendar < 3.2.2 - Unauthenticated Arbitrary File Upload
The Booking calendar, Appointment Booking System WordPress plugin before 3.2.2 does not validate uploaded files, which could allow unauthenticated users to upload arbitrary files, such as PHP and achieve RCE
-
High 7.8
WP CSV Exporter < 1.3.7 - CSV Injection
The WP CSV Exporter WordPress plugin before 1.3.7 does not properly escape the fields when exporting data as CSV, leading to a CSV injection vulnerability.
-
Medium 5.4
Supra CSV <= 4.0.3 - Stored Cross-Site Scripting via CSRF
Cross-site Scripting (XSS) is a client-side code injection attack. The attacker aims to execute malicious scripts in a web browser of the victim by including malicious code in a legitimate web page or web application.
-
High 8.8
Icegram Express < 5.5.1 - Subscriber+ SQLi
The Icegram Express WordPress plugin before 5.5.1 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscriber
-
Critical 9.8
Dokan < 3.7.6 - Unauthenticated SQLi
The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users
-
Medium 4.3
Donation Button <= 4.0.0 - Subscriber+ Broken Access Control leading to SMS Spam
The Donation Button WordPress plugin through 4.0.0 does not properly check for privileges and nonce tokens in its "donation_button_twilio_send_test_sms" AJAX action, which may allow any users with an account on the affected site, like subscribers, to use the …
-
Medium 5.4
Welcart e-Commerce < 2.8.4 - Multiple Subscriber+ Stored Cross-Site Scripting
The Welcart e-Commerce WordPress plugin before 2.8.4 does not sanitise and escape some parameters, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks
-
Medium 4.8
Jetpack CRM < 5.4.3 - Admin+ Cross-Site Scripting
The Jetpack CRM WordPress plugin before 5.4.3 does not sanitise and escape its settings, allowing high privilege users such as admin to perform cross-Site Scripting attacks even when the unfiltered_html capability is disallowed.
-
Medium 5.4CVE-2022-3934 Scanner template
Flat PM < 3.0.13 - Reflected Cross-Site Scripting
The FlatPM WordPress plugin before 3.0.13 does not sanitise and escape some parameters before outputting them back in pages, leading to Reflected Cross-Site Scripting which could be used against high privilege users such as admin
-
Medium 5.4
Donation Button <= 4.0.0 - Contributor+ Stored XSS
The Donation Button WordPress plugin through 4.0.0 does not sanitize and escapes some parameters, which could allow users with a role as low as Contributor to perform Cross-Site Scripting attacks.
-
High 7.2
Buddybadges <= 1.0.0 - Admin+ SQLi
The buddybadges WordPress plugin through 1.0.0 does not sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users
-
Medium 5.4CVE-2022-3933 Scanner template
Essential Real Estate < 3.9.6 - Reflected Cross-Site-Scripting
The Essential Real Estate WordPress plugin before 3.9.6 does not sanitize and escapes some parameters, which could allow users with a role as low as Admin to perform Cross-Site Scripting attacks.
-
Medium 6.5
StopBadBots < 7.24 - Subscriber+ Arbitrary Plugin Installation
The Block Bad Bots and Stop Bad Bots Crawlers and Spiders and Anti Spam Protection WordPress plugin before 7.24 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and acti…
-
Medium 5.3
All In One WP Security & Firewall < 5.0.8 - IP Spoofing
The All-In-One Security (AIOS) WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features (like IP blocks, rate limiting, brute force protection, and more).
-
High 7.5
User Registration < 2.2.4.1 - Subscriber+ Arbitrary File Upload
The User Registration WordPress plugin before 2.2.4.1 does not properly restrict the files to be uploaded via an AJAX action available to both unauthenticated and authenticated users, which could allow unauthenticated users to upload PHP files for example.
-
Medium 6.5
WP Memory < 2.46 - Subscriber+ Arbitrary Plugin Installation
The Memory Usage, Memory Limit, PHP and Server Memory Health Check and Fix Plugin WordPress plugin before 2.46 does not have proper authorisation and CSRF in an AJAX action, allowing any authenticated users, such as subscriber to call it and install and activ…
-
Medium 6.1CVE-2022-3908 Scanner template
Helloprint < 1.4.7 - Reflected Cross-Site Scripting
The Helloprint WordPress plugin before 1.4.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting
-
High 8.8
Shortcodes and extra features for Phlox theme < 2.10.7 - PHP Objection Injection
The Shortcodes and extra features for Phlox theme WordPress plugin before 2.10.7 unserializes the content of an imported file, which could lead to PHP object injection when a user imports (intentionally or not) a malicious file and a suitable gadget chain is …
-
Medium 5.5
A cleartext storage of sensitive information vulnerability exists in PcVue versions 8.10 through 15.2.3. This could all…
-
Medium 4.7
An insertion of sensitive information into log file vulnerability exists in PcVue versions 15 through 15.2.2. This coul…