CVE-2024-4787

The CVE refers to Cost Calculator Builder PRO for WordPress. It is vulnerable in versions up to 3.1.75 to an unauthenticated arbitrary email sending issue. The bug arises from insufficient limitations on both the recipient and the email content in the AJAX-accessible functions send_pdf and send_p...

CVE-2024-4787 Cost Calculator Builder PRO <= 3.1.75 - Unauthenticated Arbitrary Email Sending

The Cost Calculator Builder PRO for WordPress is vulnerable to arbitrary email sending vulnerability in versions up to, and including, 3.1.75. This is due to insufficient limitations on the email recipient and the content in the 'sendpdf' and the 'sendpdffront' functions which are reachable via...

WordPress plugin Cost Calculator Builder PRO security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Cost Calculator Builder PRO plugin <= 3.1.75 - Unauthenticated Arbitrary Email Sending vulnerability

Unauthenticated Arbitrary Email Sending vulnerability discovered by István Márton in WordPress Plugin Cost Calculator Builder Pro versions = 3.1.75...

WordPress Cost Calculator Builder Pro Plugin <= 3.1.75 is vulnerable to Content Spoofing

Software Cost Calculator Builder Pro Type Plugin Vulnerable versions = 3.1.75 Fixed in 3.1.76 OWASP Top 10 A1: Broken Access Control Classification Content Spoofing CVE CVE-2024-4787 Patch priority Low CVSS severity Low 5.3 Developer Claim ownership PSID 4a7f50b226bd Credits István Márton Require...

Malicious code in calculator-avishek (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 483f32930a5b1005404615c7c7b5063cd48501972c1b0e0dd439f5ec4740b67b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2024-1504 Malicious code in calculator-avishek (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 483f32930a5b1005404615c7c7b5063cd48501972c1b0e0dd439f5ec4740b67b Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

PoolParty - A Set Of Fully-Undetectable Process Injection Techniques Abusing Windows Thread Pools

A collection of fully-undetectable process injection techniques abusing Windows Thread Pools. Presented at Black Hat EU 2023 Briefings under the title - injection-techniques-using-windows-thread-pools-35446"The Pool Party You Will Never Forget: New Process Injection Techniques UsingWindows Thread...

CVE-2024-4789

Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the senddemowebhook function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary locations...

CVE-2024-4789

CVE-2024-4789 : Cost Calculator Builder Pro for WordPress vulnerable to Server-Side Request Forgery (SSRF) via send_demo_webhook() in all versions up to 3.1.72. Exploitation requires authenticated access at subscriber level or higher, enabling the attacker to make outbound requests from the web a...

WordPress Cost Calculator Builder Pro plugin <= 3.1.72 - Authenticated (Subscriber+) Server-Side Request Forgery vulnerability

Authenticated Subscriber+ Server-Side Request Forgery vulnerability discovered by haidv35 in WordPress Plugin Cost Calculator Builder Pro versions = 3.1.72...

PT-2024-32874 · WordPress · Cost Calculator Builder

Name of the Vulnerable Software and Affected Versions: Cost Calculator Builder Pro plugin for WordPress versions up to 3.1.72 Description: The issue allows authenticated attackers with subscriber-level access and above to make web requests to arbitrary locations originating from the web...

WordPress Plugin Cost Calculator Builder Pro 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

WordPress Cost Calculator Builder Pro Plugin <= 3.1.72 is vulnerable to Server Side Request Forgery (SSRF)

Software Cost Calculator Builder Pro Type Plugin Vulnerable versions = 3.1.72 Fixed in 3.1.73 OWASP Top 10 A1: Injection Classification Server Side Request Forgery SSRF CVE CVE-2024-4789 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID eba410ca734c Credits haidv35...

Cost Calculator Builder Pro < 3.1.73 - Authenticated (Subscriber+) Server-Side Request Forgery

Description Cost Calculator Builder Pro plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to 3.1.72, via the senddemowebhook function. This makes it possible for authenticated attackers, with subscriber-level access and above, to make web requests to arbitrary...

WordPress Plugin Cost Calculator Builder Pro 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A cross-site scripting vulnerability exists...

WordPress plugin AA Cash Calculator 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

PT-2024-15864 · WordPress · Aa Cash Calculator

Name of the Vulnerable Software and Affected Versions: AA Cash Calculator plugin for WordPress version 1.0 and earlier Description: The issue is related to Reflected Cross-Site Scripting via the invoice parameter due to insufficient input sanitization and output escaping. This allows...

WordPress Cost Calculator Builder Pro plugin <= 3.1.67 - Unauthenticated Cross-Site Scripting via SVG Upload vulnerability

Unauthenticated Cross-Site Scripting via SVG Upload vulnerability discovered by andrea bocchetti in WordPress Plugin Cost Calculator Builder Pro versions = 3.1.67...

WordPress AA Cash Calculator plugin <= 1.0 - Reflected Cross-Site Scripting via invoice vulnerability

Reflected Cross-Site Scripting via invoice vulnerability discovered by Nathaniel Oh 0x4n3 in WordPress Plugin AA Cash Calculator versions = 1.0...