CVE-2021-25078

The CVE affects the WordPress plugin Affiliates Manager up to version 2.9.0. The issue arises because the plugin does not validate, sanitize, or escape the IP address in requests logged by the click-tracking feature, enabling unauthenticated attackers to trigger Cross-Site Scripting when an admin...

CVE-2021-25078 Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

The Affiliates Manager WordPress plugin before 2.9.0 does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests...

WordPress plugin 跨站脚本漏洞

WordPress is the WordPress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blogging sites on servers with PHP and MySQL. cross-site scripting vulnerability exists in versions of the WordPress plugin Affiliates Manager prior to...

Stolen TikTok Videos, Bent on Fraud, Invade YouTube Shorts

Scammers are taking full advantage of the launch of Google’s new TikTok competitor, YouTube Shorts, which has turned out to be an awesome tool for feeding billions of engaged viewers stolen content. That content is being used to run rackets like promoting adult dating websites, hustling diet pill...

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

The plugin does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests. PoC As unauthenticated: wget "https://example.com/?wpamid=1"...

Affiliates Manager < 2.9.0 - Unauthenticated Stored Cross-Site Scripting

The plugin does not validate, sanitise and escape the IP address of requests logged by the click tracking feature, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admin viewing the tracked requests. As unauthenticated: wget "https://example.com/?wpamid=1"...

WordPress Affiliates Manager plugin <= 2.8.9 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered in WordPress Affiliates Manager plugin versions = 2.8.9. Solution Update the WordPress Affiliates Manager plugin to the latest available version at least 2.9.0...

Hackers Begin Exploiting Second Log4j Vulnerability as a Third Flaw Emerges

Web infrastructure company Cloudflare on Wednesday revealed that threat actors are actively attempting to exploit a second bug disclosed in the widely used Log4j logging utility, making it imperative that customers move quickly to install the latest version as a barrage of attacks continues to...

Ransomware Affiliate Arrested in Romania; 51 Stolen Data Brokers Arrested in Ukraine

Europol, the European Union's premier law enforcement agency, has announced the arrest of a third Romanian national for his role as a ransomware affiliate suspected of hacking high-profile organizations and companies and stealing large volumes of sensitive data. The 41-year-old unnamed individual...

When Scammers Get Scammed, They Take It to Cybercrime Court

Blocked from legitimate courts, cybercriminals have set up their own system for settling disputes, handing over ultimate decision-making to senior underground forum administrators who have awarded claims totaling as much as $20 million. A new report from Analyst1 details activities inside these...

WordPress Plugin SQL Injection Vulnerability (CNVD-2021-101156)

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. WordPress Affiliates Manager is vulnerable to a SQ...

Suspected REvil Ransomware Affiliates Arrested in Global Takedown

Romanian law enforcement authorities have announced the arrest of two individuals for their roles as affiliates of the REvil ransomware family, dealing a severe blow to one of the most prolific cybercrime gangs in history. The suspects are believed to have orchestrated more than 5,000 ransomware...

REvil Affiliates Arrested; DOJ Seizes $6M in Ransom

International law enforcement is squeezing REvil affiliates out of hiding, but the underground is shrugging it off: They know that Russia won’t touch a hair on the heads of the Russian-speaking ransomware operators, experts say. On Monday, Europol announced the arrest of a total of seven suspecte...

CVE-2021-24844

The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue...

CVE-2021-24844

The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue...

Sql injection

The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue...

CVE-2021-24844 Affiliate Manager < 2.8.7 - Admin+ SQL injection

The Affiliates Manager WordPress plugin before 2.8.7 does not validate the orderby parameter before using it in an SQL statement in the admin dashboard, leading to an SQL Injection issue...

CVE-2021-24844

The CVE-2021-24844 entry affects the WordPress Affiliates Manager plugin (

WordPress SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platforms developed using the PHP language. The platform supports the hosting of personal blog sites on PHP and MySQL servers. WordPress Plugin is a WordPress open source application plugin. WordPress Affiliates Manager is vulnerable to a SQ...

Who Will Bend the Knee in RaaS Game of Thrones in 2022?

ARCHIVED STORY Who Will Bend the Knee in RaaS Game of Thrones in 2022? By John Fokker and Raj Samani · November 07, 2021 McAfee Enterprise and FireEye recently released its 2022 Threat Predictions. In this blog, we take a deeper dive into a Game of Thrones power struggle among...