CVE-2023-0156

Идентификатор CVE : CVE-2023-0156 Тип уязвимости : Обход каталога Описание : Плагин All-In-One Security AIOS для WordPress уязвим к обходу каталога в версиях до 5.1.4 включительно. Это позволяет аутентифицированным злоумышленникам с правами администратора читать содержимое произвольных файлов на...

CVE-2026-8438: Improper Neutralization of Input During Web Page Generation

The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the getrestroute function and missing output escaping in the columndefault method of the...

CVE-2024-1037: Improper Neutralization of Input During Web Page Generation

The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...

CVE-2023-0157: Improper Neutralization of Input During Web Page Generation

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not escape the content of log files before outputting it to the plugin admin page, allowing an authorized user admin+ to plant bogus log files containing malicious JavaScript code that will be executed in the context of any...

CVE-2023-0156: Improper Limitation of a Pathname to a Restricted Directory

The All-In-One Security AIOS WordPress plugin before 5.1.5 does not limit what log files to display in it's settings pages, allowing an authorized user admin+ to view the contents of arbitrary files and list directories anywhere on the server to which the web server has access. The plugin only...

CVE-2022-4346: Undefined Security Weakness

The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...

CVE-2022-4097: Authorization Bypass Through User-Controlled Key

The All-In-One Security AIOS WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features like IP blocks, rate limiting, brute force protection, and more...

CVE-2022-44737: Cross-Site Request Forgery (CSRF)

Multiple Cross-Site Request Forgery vulnerabilities in All-In-One Security AIOS – Security and Firewall WordPress plugin = 5.1.0 on WordPress...