CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44598)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxcrons.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from failure to properly validate a user-supplied string before executing a system call. An...

CentOS Web Panel SQL Injection Vulnerability (CNVD-2020-44592)

CentOS Web Panel CWP is a free web hosting control panel. A SQL injection vulnerability exists in the ajaxlistaccounts.php file in CentOS Web Panel cwp-e version 17.0.9.8.923, which stems from the program not properly validating a user-supplied string. An attacker could exploit this vulnerability...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44593)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxdashboard.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from failure to properly validate a user-supplied string before executing a system call...

CentOS Web Panel SQL Injection Vulnerability (CNVD-2020-44588)

CentOS Web Panel CWP is a free web hosting control panel. A SQL injection vulnerability exists in the ajaxmailautoreply.php file in CentOS Web Panel cwp-e version 17.0.9.8.923, which originates from the program not properly validating a user-supplied string. An attacker could exploit this...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44602)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxmodsecurity.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from a failure to properly validate user-supplied strings before executing system...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-44600)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxmodsecurity.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from the program failing to properly validate a system call before executing it with ...

Newsletter WordPress Plugin Opens Door to Site Takeover

Newsletter, a WordPress plugin with more than 300,000 installations, has a pair of vulnerabilities that could lead to code-execution and even site takeover. The Newsletter plugin offers site admins a visual editor that can be used to create newsletters and email campaigns from within WordPress...

The Official WordPress Facebook Chat Plugin < 1.6 - Authenticated Options Change to Chat Takeover

This flaw made it possible for low-level authenticated attackers to connect their own Facebook Messenger account to any site running the vulnerable plugin and engage in chats with site visitors on affected sites. Obtain PageID from a test Facebook Page found under page - about - pageID. Use this...

CMP - Coming Soon & Maintenance < 3.8.2 - Improper Access Controls on AJAX Calls

Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin deactivation...

Newsletter < 6.8.2 - Authenticated Cross-Site Scripting (XSS)

Newsletter suffers from an Authenticated Reflected Cross-Site ScriptingXSS vulnerability via the ‘tnpcrender’ AJAX action found in newsletter/emails/emails.php. Due to how the corresponding ‘tnpcrendercallback‘ function decodes input via the ‘restoreoptionsfromrequest’ function and renders them v...

Newsletter < 6.8.2 - Authenticated PHP Object Injection

The ‘restoreoptionsfromrequest‘ function called by the AJAX function ‘tnpcrendercallback‘ runs ‘unserialize’ directly on ‘$options'inlineedits'’ which is provided by user input in the $POST‘options’ parameter. This creates the potential for an Object Injection vulnerability. For example, a user...

CentOS Web Panel ajax_list_accounts.php file SQL injection vulnerability

CentOS Web Panel CWP is a free web hosting control panel. A SQL injection vulnerability exists in the ajaxlistaccounts.php file in CentOS Web Panel cwp-e version 17.0.9.8.923, which stems from the program not properly validating a user-supplied string. An attacker could exploit this vulnerability...

CentOS Web Panel ajax_new_account.php file SQL injection vulnerability

CentOS Web Panel CWP is a free web hosting control panel. A SQL injection vulnerability exists in the ajaxnewaccount.php file in CentOS Web Panel cwp-e version 17.0.9.8.923, which originates when the program does not properly validate a user-supplied string. An attacker could exploit this...

CentOS Web Panel ajax_dashboard.php file command injection vulnerability

CentOS Web Panel CWP is a free web hosting control panel. A security vulnerability in the ajaxdashboard.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release stems from a failure to properly validate a user-supplied string before executing a system call. An attacker can exploit this...

CentOS Web Panel ajax_dashboard.php File SQL Injection Vulnerability

CentOS Web Panel CWP is a free web hosting control panel. A SQL injection vulnerability exists in the ajaxdashboard.php file in CentOS Web Panel cwp-e version 17.0.9.8.923, which originates when the program does not properly validate a user-supplied string. An attacker could exploit the...

CentOS Web Panel Operating System Command Injection Vulnerability (CNVD-2020-43609)

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxadminapis.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from failure to properly validate user-supplied strings before executing system calls. ...

VulnCheck KEV: CVE-2020-36668

The JetBackup – WP Backup, Migrate & Restore plugin for WordPress is vulnerable to sensitive information disclosure in versions up to, and including, 1.4.0 due to a lack of proper capability checking on the backupguardgetmanualmodal function called via an AJAX action. This makes it possible...

CentOS Web Panel Operating System Command Injection Vulnerability

CentOS Web Panel CWP is a free web hosting control panel. An operating system command injection vulnerability exists in the ajaxftpmanager.php file in the CentOS Web Panel cwp-el7-0.9.8.891 release, which stems from the program failing to properly validate a system call before executing it with a...

CentOS Web Panel SQL Injection Vulnerability (CNVD-2020-43612)

CentOS Web Panel CWP is a free web hosting control panel. A SQL injection vulnerability exists in the ajaxlistaccounts.php file in CentOS Web Panel cwp-e version 17.0.9.8.923, which stems from the program not properly validating a user-supplied string. An attacker could exploit this vulnerability...

CentOS Web Panel SQL Injection Vulnerability (CNVD-2020-43613)

CentOS Web Panel CWP is a free web hosting control panel. A SQL injection vulnerability exists in the ajaxmailautoreply.php file in CentOS Web Panel cwp-e version 17.0.9.8.923, which originates from the program not properly validating a user-supplied string. An attacker could exploit this...