Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
cve[email protected]CVE-2018-3810
HistoryJan 01, 2018 - 6:29 a.m.

CVE-2018-3810

2018-01-0106:29:00
CWE-287
[email protected]
web.nvd.nist.gov
44
security
vulnerability
oturia smart google code inserter
authentication bypass
wordpress
cve-2018-3810
nvd
javascript
html

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.773 High

EPSS

Percentile

98.2%

JSON

Authentication Bypass vulnerability in the Oturia Smart Google Code Inserter plugin before 3.5 for WordPress allows unauthenticated attackers to insert arbitrary JavaScript or HTML code (via the sgcgoogleanalytic parameter) that runs on all pages served by WordPress. The saveGoogleCode() function in smartgooglecode.php does not check if the current request is made by an authorized user, thus allowing any unauthenticated user to successfully update the inserted code.

Affected configurations

NVD
Node
oturiasmart_google_code_inserterRange<3.5wordpress

Related

patchstack 2
cvelist 1
wpvulndb 1
nuclei 1
nvd 1
prion 1
openvas 1
zdt 1
exploitpack 1
packetstorm 1
exploitdb 1
patchstack
patchstack
WordPress Smart Google Code Inserter plugin <=3.4 - Authorization bypass vulnerability
2018-01-03 00:00:00
WordPress Smart Google Code Inserter plugin <= 3.4 - Unauthenticated Cross-Site Scripting (XSS) vulnerability
2018-01-08 00:00:00
cvelist
cvelist
CVE-2018-3810
2018-01-01 06:00:00
wpvulndb
wpvulndb
Smart Google Code Inserter <= 3.4 - Unauthenticated Cross-Site Scripting (XSS)
2018-01-01 00:00:00
nuclei
nuclei
Oturia WordPress Smart Google Code Inserter <3.5 - Authentication Bypass
2021-03-10 11:36:11
nvd
nvd
CVE-2018-3810
2018-01-01 06:29:00
prion
prion
Authentication flaw
2018-01-01 06:29:00
openvas
openvas
WordPress Smart Google Code Inserter Plugin < 3.5 Multiple Vulnerabilities
2018-01-02 00:00:00
zdt
zdt
WordPress Smart Google Code Inserter Plugin < 3.5 - Authentication Bypass / SQL Injection
2018-01-03 00:00:00
exploitpack
exploitpack
WordPress Plugin Smart Google Code Inserter 3.5 - Authentication Bypass SQL Injection
2018-01-03 00:00:00
packetstorm
packetstorm
WordPress Smart Google Code Inserter SQL Injection
2018-01-03 00:00:00
exploitdb
exploitdb
WordPress Plugin Smart Google Code Inserter &lt; 3.5 - Authentication Bypass / SQL Injection
2018-01-03 00:00:00

7.5 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

9.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

9.3 High

AI Score

Confidence

High

0.773 High

EPSS

Percentile

98.2%

JSON
Related for CVE-2018-3810
patchstack2cvelist1wpvulndb1nuclei1nvd1prion1openvas1zdt1exploitpack1packetstorm1exploitdb1