412 matches found
CVE-2023-5939: Undefined Security Weakness
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users...
CVE-2023-5931: Unrestricted Upload of File with Dangerous Type
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.6.16 does not validate files to be uploaded, which could allow attackers with a low-privilege account e.g. subscribers to upload arbitrary files such as PHP on the server...
rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCE
Description The plugin does not validate files to be uploaded, which could allow attackers with a low-privilege account e.g. subscribers to upload arbitrary files such as PHP on the server If plugin JSON API is enabled, any logged-in user may execute arbitrary code by uploading a PHP file. After...
rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Admin+ RCE
Description The plugin loads the contents of the import file in an unsafe manner, leading to remote code execution by privileged users. 1. As an admin, visit rtMedia Settings Export/Import. 2. Click the "Browse File" button beside "Import rtMedia Settings". 3. Upload a file with the extension .js...
rtMedia for WordPress, BuddyPress and bbPress < 4.6.16 - Subscriber+ RCE
Description The plugin does not validate files to be uploaded, which could allow attackers with a low-privilege account e.g. subscribers to upload arbitrary files such as PHP on the server PoC If plugin JSON API is enabled, any logged-in user may execute arbitrary code by uploading a PHP file...
rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization to Sensitive Information Exposure
Description The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the exportsettings function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with...
rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization to Settings Update
Description The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the rtmediaadminupload function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers,...
rtMedia for WordPress, BuddyPress and bbPress < 4.6.15 - Missing Authorization via export_settings
Description The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to unauthorized data access due to a missing capability check on the exportsettings function in versions up to, and including, 4.6.14. This makes it possible for authenticated attackers, with...
CVE-2023-34031
Cross-Site Request Forgery CSRF vulnerability in Pascal Casier bbPress Toolkit plugin = 1.0.12 versions...
CVE-2023-34031
A vulnerability in Pascal Casier bbPress Toolkit bbp-toolkit.This issue affects bbPress Toolkit: from n/a through = 1.0.12...
CVE-2023-34031
Cross-Site Request Forgery CSRF vulnerability in Pascal Casier bbPress Toolkit plugin = 1.0.12 versions...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF vulnerability in Pascal Casier bbPress Toolkit plugin = 1.0.12 versions...
CVE-2023-34031
CVE-2023-34031 describes a Cross-Site Request Forgery (CSRF) in the WordPress plugin bbPress Toolkit by Pascal Casier, affecting versions up to and including 1.0.12 . The vulnerability is unauthenticated and can be triggered when a user interacts with a crafted request, potentially allowing an at...
CVE-2023-34031 WordPress bbPress Toolkit Plugin <= 1.0.12 is vulnerable to Cross Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Pascal Casier bbPress Toolkit plugin = 1.0.12 versions...
CVE-2023-34031 WordPress bbPress Toolkit plugin <= 1.0.12 - Cross Site Request Forgery (CSRF) vulnerability
A vulnerability in Pascal Casier bbPress Toolkit bbp-toolkit.This issue affects bbPress Toolkit: from n/a through = 1.0.12...
PT-2023-24647 · Pascal Casier · Bbpress Toolkit Plugin
Name of the Vulnerable Software and Affected Versions: Pascal Casier bbPress Toolkit plugin versions 1.0.12 and earlier Description: The issue is a Cross-Site Request Forgery CSRF vulnerability. This means an attacker can trick a user into performing unintended actions on a web application that t...
CVE-2023-34031: Cross-Site Request Forgery (CSRF)
Cross-Site Request Forgery CSRF vulnerability in Pascal Casier bbPress Toolkit plugin = 1.0.12 versions...
WordPress rtMedia for WordPress, BuddyPress and bbPress Plugin <= 4.6.14 is vulnerable to Broken Access Control
Software rtMedia for WordPress, BuddyPress and bbPress Type Plugin Vulnerable versions = 4.6.14 Fixed in 4.6.15 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-41951 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID ed1b3e5c3460 Credi...