1426 matches found
WordPress All-in-One WP Migration Dropbox Extension Plugin <= 3.75 is vulnerable to Broken Access Control
Software All-in-One WP Migration Dropbox Extension Type Plugin Vulnerable versions = 3.75 Fixed in 3.76 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40004 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 517b1424056f Credits Raf...
WordPress All-in-One WP Migration OneDrive Extension Plugin <= 1.66 is vulnerable to Broken Access Control
Software All-in-One WP Migration OneDrive Extension Type Plugin Vulnerable versions = 1.66 Fixed in 1.67 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-40004 Patch priority High CVSS severity High 7.3 Developer Claim ownership PSID 11686f7de85d Credits...
CVE-2023-3248 All-in-one Floating Contact Form < 2.1.2 - Admin+ Stored Cross-Site Scripting
The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...
WordPress Plugin All-in-One Floating Contact Form: Cross-Site Script Vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...
CVE-2023-3248: Undefined Security Weakness
The All-in-one Floating Contact Form WordPress plugin before 2.1.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite...
WordPress All in One Video Downloader Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)
Software All in One Video Downloader Type Plugin Vulnerable versions = 1.0.2 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 83138c5b2fe4 Credits Rafie Muhammad...
Malware in all-in-one-web-header-footer
Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be rotated immediately from a different computer. The package should be removed, but as full control of the computer may have been given to an outsid...
CVE-2023-2493
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2023-2493 All In One Redirection < 2.2.0 - Admin+ SQLi
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
CVE-2023-2493
CVE-2023-2493 affects the WordPress plugin All In One Redirection (before 2.2.0). It allows SQL injection due to unsanitized/escaped parameters used in SQL statements, exploitable by high-privilege users (e.g., admins). Multiple sources confirm the vulnerability; patches exist—update to 2.2.0 or ...
WordPress plugin “All In One Redirection” has a SQL injection vulnerability
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...
PT-2023-19835
Name of the Vulnerable Software and Affected Versions All In One Redirection WordPress plugin versions prior to 2.2.0 Description The issue arises from improper sanitization and escaping of multiple parameters before their use in an SQL statement, leading to a SQL injection. This can be exploited...
CVE-2023-2493: Undefined Security Weakness
The All In One Redirection WordPress plugin before 2.2.0 does not properly sanitise and escape multiple parameters before using them in an SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...
Nextcloud: Nextcloud All-In-One path disclosure of internal frontend
Vulnerability description not provided...
CVE-2023-29435
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Zwaply Cryptocurrency All-in-One plugin = 3.0.19 versions...
CVE-2023-29435
CVE-2023-29435 : Auth. (contributor+) Stored Cross-Site Scripting (XSS) in the WordPress plugin “Cryptocurrency All-in-One” (WordPress Cryptocurrency All-in-One Plugin) up to version 3.0.19. Public data confirms the vulnerable component is the plugin; root cause is stored XSS as stated, with an a...
PT-2023-22259
Name of the Vulnerable Software and Affected Versions Zwaply Cryptocurrency All-in-One plugin versions prior to 3.0.20 Description The issue is related to a Stored Cross-Site Scripting XSS vulnerability. This type of vulnerability allows an attacker to inject malicious scripts into a website, whi...
CVE-2023-29435: Improper Neutralization of Input During Web Page Generation
Auth. contributor+ Stored Cross-Site Scripting XSS vulnerability in Zwaply Cryptocurrency All-in-One plugin = 3.0.19 versions...
