CVE-2023-37957: Cross-Site Request Forgery (CSRF)

A cross-site request forgery CSRF vulnerability in Jenkins Pipeline restFul API Plugin 0.11 and earlier allows attackers to connect to an attacker-specified URL, capturing a newly generated JCLI token...

PT-2023-26205

Name of the Vulnerable Software and Affected Versions Jenkins Pipeline restFul API Plugin versions 0.11 and earlier Description A cross-site request forgery CSRF vulnerability allows attackers to connect to an attacker-specified URL, capturing a newly generated JCLI token. This enables attackers ...

PT-2023-23568

Name of the Vulnerable Software and Affected Versions MStore API plugin for WordPress affected versions not specified Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the mstore update firebase server key function. This allows unauthenticated...

CVE-2023-3077

The MStore API WordPress plugin before 3.9.8 does not sanitise and escape a parameter before using it in a SQL statement, leading to a Blind SQL injection exploitable by unauthenticated users. This is only exploitable if the site owner elected to pay to get access to the plugins' pro features, an...

CVE-2023-3076

The MStore API WordPress plugin before 3.9.9 does not prevent visitors from creating user accounts with the role of their choice via their wholesale REST API endpoint. This is only exploitable if the site owner paid to access the plugin's pro features...

CVE-2023-3197 MStore API <= 4.0.1 - Unauthenticated SQL Injection

The MStore API plugin for WordPress is vulnerable to Unauthenticated Blind SQL Injection via the 'id' parameter in versions up to, and including, 4.0.1 due to insufficient escaping on the user supplied parameters and lack of sufficient preparation on the existing SQL query. This makes it possible...

Sql injection

Unauth. SQL Injection SQLi vulnerability in InspireUI MStore API plugin = 3.9.7 versions...

CVE-2022-47614

CVE-2022-47614 : Unauth. SQL Injection in the InspireUI MStore API WordPress plugin, affected versions

CVE-2022-47614

Unauth. SQL Injection SQLi vulnerability in InspireUI MStore API plugin = 3.9.7 versions...

CVE-2022-47614: Improper Neutralization of Special Elements used in an SQL Command

Unauth. SQL Injection SQLi vulnerability in InspireUI MStore API plugin = 3.9.7 versions...

CVE-2023-3203

The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstoreupdatelimitproduct function. This makes it possible for unauthenticated attackers to update limit the number of product per category to use cache data in home screen via a...

CVE-2023-3201

The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstoreupdatenewordertitle function. This makes it possible for unauthenticated attackers to update new order title via a forged request granted they can trick a site administrato...

CVE-2023-3198 MStore API <= 3.9.6 - Cross-Site Request Forgery to Order Status Update

The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstoreupdatestatusordermessage function. This makes it possible for unauthenticated attackers to update status order message via a forged request granted they can trick a site...

PT-2023-23569

Name of the Vulnerable Software and Affected Versions MStore API plugin for WordPress affected versions not specified Description The MStore API plugin for WordPress is vulnerable to Cross-Site Request Forgery due to missing nonce validation on the mstore update limit product function. This makes...

PT-2023-23567

Name of the Vulnerable Software and Affected Versions MStore API plugin for WordPress affected versions not specified Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the mstore update new order title function. This allows unauthenticated attackers...

PT-2023-23552

Name of the Vulnerable Software and Affected Versions MStore API plugin for WordPress affected versions not specified Description The issue is related to Cross-Site Request Forgery due to missing nonce validation on the mstore update status order message function. This allows unauthenticated...

CVE-2023-2734

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.1. This is due to insufficient verification on the user being supplied during the cart sync from mobile REST API request through the plugin. This makes it possible for unauthenticated...

CVE-2023-2733

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This makes it possible for unauthenticated...

CVE-2023-2732 MStore API <= 3.9.2 - Authentication Bypass

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.2. This is due to insufficient verification on the user being supplied during the add listing REST API request through the plugin. This makes it possible for unauthenticated attackers ...

CVE-2023-2733 MStore API <= 3.9.0 - Authentication Bypass

The MStore API plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 3.9.0. This is due to insufficient verification on the user being supplied during the coupon redemption REST API request through the plugin. This makes it possible for unauthenticated...