Lucene search

K

User Activity Security Vulnerabilities

cve
cve

CVE-2024-32137

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin User Activity Log Pro.This issue affects User Activity Log Pro: from n/a through...

8.5CVSS

7.5AI Score

0.0004EPSS

2024-04-15 08:15 AM
32
cve
cve

CVE-2024-31356

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log.This issue affects User Activity Log: from n/a through...

7.6CVSS

9.7AI Score

0.0004EPSS

2024-04-10 05:15 PM
32
cve
cve

CVE-2022-45350

Improper Neutralization of Formula Elements in a CSV File vulnerability in Pär Thernström Simple History – user activity log, audit tool.This issue affects Simple History – user activity log, audit tool: from n/a through...

8.8CVSS

8.6AI Score

0.001EPSS

2023-11-07 03:15 PM
23
cve
cve

CVE-2023-37966

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log user-activity-log allows SQL Injection.This issue affects User Activity Log: from n/a through...

9.8CVSS

9.7AI Score

0.001EPSS

2023-10-31 03:15 PM
34
cve
cve

CVE-2023-5167

The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard, which may allow visitors to conduct Stored Cross-Site Scripting...

5.4CVSS

5.4AI Score

0.0004EPSS

2023-10-16 08:15 PM
22
cve
cve

CVE-2023-5133

This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious...

7.5CVSS

7.6AI Score

0.0005EPSS

2023-10-16 08:15 PM
21
cve
cve

CVE-2023-4279

This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker to manipulate its value. This may be used to hide the source of malicious...

7.5CVSS

7.5AI Score

0.0005EPSS

2023-09-04 12:15 PM
30
cve
cve

CVE-2023-4269

The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated users, such as subscriber to perform such action and retrieve PII such as email...

4.3CVSS

4.9AI Score

0.0004EPSS

2023-09-04 12:15 PM
21
cve
cve

CVE-2023-4150

The User Activity Tracking and Log WordPress plugin before 4.0.9 does not have proper CSRF checks when managing its license, which could allow attackers to make logged in admins update and deactivate the plugin's license via CSRF...

4.3CVSS

4.9AI Score

0.0005EPSS

2023-08-30 03:15 PM
24
cve
cve

CVE-2023-3435

The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection...

9.8CVSS

9.8AI Score

0.001EPSS

2023-08-14 08:15 PM
43
cve
cve

CVE-2023-2761

The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the txtsearch parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as...

7.2CVSS

7.1AI Score

0.001EPSS

2023-07-24 11:15 AM
34
cve
cve

CVE-2022-4550

The User Activity WordPress plugin through 1.0.1 checks headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP...

7.5CVSS

7.4AI Score

0.001EPSS

2023-02-27 04:15 PM
24
cve
cve

CVE-2019-10219

A vulnerability was found in Hibernate-Validator. The SafeHtml validator annotation fails to properly sanitize payloads consisting of potentially malicious code in HTML comments and instructions. This vulnerability can result in an XSS...

6.1CVSS

6AI Score

0.002EPSS

2019-11-08 03:15 PM
168
6