7 matches found
CVE-2026-13369
creationtimestamp| type| source ---|---|--- 2026-07-02 13:15:07+00:00| seen| https://bsky.app/profile/atomicedge.bsky.social/post/3mpo4gghvii2l 2026-07-02 22:22:43+00:00| seen| https://bsky.app/profile/kriptabiz.bsky.social/post/3mpp2zmhr5l26 2026-07-03 03:32:52+00:00| seen|...
CVE-2026-13369
The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Arbitrary File Read via the attachfiles function in versions up to, and including, 3.3.29. This is due to the getfilesforattachment function accepting a raw attacker-controlled 'files' array when the process method returns early...
CVE-2025-13369
The Premmerce WooCommerce Customers Manager plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'moneyspentfrom', 'moneyspentto', 'registeredfrom', and 'registeredto' parameters in all versions up to, and including, 1.1.14 due to insufficient input sanitization and output...
CVE-2024-13369
The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘reviewid’ parameter in all versions up to, and including, 5.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2024-13369
The Tour Master - Tour Booking, Travel, Hotel plugin for WordPress is vulnerable to time-based SQL Injection via the ‘reviewid’ parameter in all versions up to, and including, 5.3.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL...
CVE-2024-13369
CVE-2024-13369 affects the WordPress plugin Tour Master - Tour Booking, Travel, Hotel . It is a time-based SQL Injection via the parameter review_id in all versions up to 5.3.6. Exploitation requires authentication at Subscriber+ level and can be used to extract data from the database. The issue ...