CVE-2023-23711 WordPress A2 Optimized WP Plugin <= 3.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in A2 Hosting A2 Optimized WP plugin = 3.0.4 versions...

CVE-2023-23711

CVE-2023-23711 concerns the A2 Hosting A2 Optimized WP plugin (

PT-2023-19151 · WordPress · A2 Optimized Wp

Name of the Vulnerable Software and Affected Versions: A2 Optimized WP plugin versions = 3.0.4 Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that the user is authenticated...

WordPress plugin A2 Optimized WP 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

WordPress Zendrop – Global Dropshipping Plugin <= 1.0.0 is vulnerable to Arbitrary File Upload

Software Zendrop – Global Dropshipping Type Plugin Vulnerable versions = 1.0.0 Fixed in 1.0.1 OWASP Top 10 A2: Broken Authentication Classification Arbitrary File Upload CVE CVE-2023-25970 Patch priority High CVSS severity High 10 Developer Claim ownership PSID 180f30af21a8 Credits Dave Jong...

GemFetch (>=0.1.3 <=0.1.6), MFEKmath (>=0.1.0 <=0.1.1) +2937 more potentially affected by unknown CVE via safemem (>=0.1.1 <=0.3.3)

safemem CARGO version =0.1.1, =0.1.3, =0.1.0, =0.1.0, =0.1.0, =0.8.16, =0.2.0, =0.1.1, =0.1.0, =0.0.6, =0.0.7-alpha.3, =0.0.7-alpha.1, =0.1.0, =0.9.2, =0.9.3 - acme2-slim =0.2.0 and more Source cves: unknown CVE Source advisory: OSV:RUSTSEC-2023-0081...

WordPress A2 Optimized WP Plugin <= 3.0.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software A2 Optimized WP Type Plugin Vulnerable versions = 3.0.4 Fixed in 3.0.5 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-23711 Patch priority Low CVSS severity Low 4.3 Developer A2 Hosting PSID f4b673fc9279 Credits Muhammad Daffa Required...

A2 Optimized WP < 3.0.5 - Data Collection Toggle via CSRF

The plugin does not have CSRF check in place when toggling its data Collection settings, which could allow attackers to make a logged in admin enabled/disable it via a CSRF attack...

WordPress Corsa Theme <= 1.5 is vulnerable to Arbitrary File Upload

Software Corsa Type Theme Vulnerable versions = 1.5 Fixed in N/A OWASP Top 10 A2: Broken Authentication Classification Arbitrary File Upload CVE CVE-2023-23970 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 4cf947f86882 Credits Dave Jong Patchstack Required privilege...

The vulnerability of the /goform/form2WizardStep4 component of the D-Link DIR-816 A2 router’s microprogramming system allows a hacker to execute arbitrary code.

The vulnerability of the /goform/form2WizardStep4 component of the D-Link DIR-816 A2 router’s microprogramming system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the wizardstep4pskpw...

The vulnerability of the setSecurity function in D-Link DIR-816 A2 microrouter’s software allows a hacker to execute arbitrary code.

The vulnerability of the setSecurity function in D-Link DIR-816 A2 router microprogramming system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the /goform/form2WizardStep54 component of the D-Link DIR-816 A2 router’s microprogramming system allows a hacker to execute arbitrary code.

The vulnerability of the /goform/form2WizardStep54 component of the D-Link DIR-816 A2 router’s microprogramming system is related to the execution of operations outside the buffer in memory. Exploiting this vulnerability allows a malicious actor to execute arbitrary code using the...

CVE-2022-43001

D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function...

CVE-2022-42999

D-Link DIR-816 A2 1.10 B05 was discovered to contain multiple command injection vulnerabilities via the admuser and admpass parameters at /goform/setSysAdm...

CVE-2022-43000

D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4pskpwd parameter at /goform/form2WizardStep4...

CVE-2022-43000

D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the wizardstep4pskpwd parameter at /goform/form2WizardStep4...

Stack overflow

D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the pskValue parameter in the setSecurity function...

Stack overflow

D-Link DIR-816 A2 1.10 B05 was discovered to contain a stack overflow via the srcip parameter at /goform/form2IPQoSTcAdd...

PT-2022-5271 · D Link · D-Link Dir-816 A2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: The issue is related to command injection vulnerabilities. These vulnerabilities can be exploited via the admuser and admpass parameters at the "/goform/setSysAdm" API endpoint. The vulnerabilit...

PT-2022-5270 · D Link · D-Link Dir-816 A2

Name of the Vulnerable Software and Affected Versions: D-Link DIR-816 A2 version 1.10 B05 Description: The issue is related to a stack overflow in the /goform/form2WizardStep4 component of the D-Link DIR-816 A2 router's firmware. This can be exploited via the wizardstep4 pskpwd parameter,...