40 matches found
CVE-2017-1002005
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contactid variable before adding it to the end of an SQL query...
CVE-2017-1002005
CVE-2017-1002005 affects the WordPress DTracker plugin (v1.5): the delete.php path uses user input for contact_id directly in an SQL query without sanitization, enabling SQL injection. Connected documents corroborate a SQL injection vulnerability in DTracker 1.5, with multiple sources flagging un...
CVE-2017-1002004
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query...
CVE-2017-1002004
The CVE-2017-1002004 entry concerns the WordPress DTracker plugin (v1.5) with an SQL injection in dtracker/download.php where user input is not sanitized for the id parameter before appending to SQL queries. Public sources in the Connected documents describe multiple unauthenticated blind SQL inj...
CVE-2017-1002007
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/savemail.php doesn't check that the user is authorized before injecting new contacts into the wpcontact table...
CVE-2017-1002006
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/savecontact.php doesn't check that the user is authorized before injecting new contacts into the wpcontact table...
CVE-2017-1002007: Missing Authorization
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/savemail.php doesn't check that the user is authorized before injecting new contacts into the wpcontact table...
CVE-2017-1002006: Missing Authorization
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/savecontact.php doesn't check that the user is authorized before injecting new contacts into the wpcontact table...
CVE-2017-1002005: Improper Neutralization of Special Elements used in an SQL Command
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contactid variable before adding it to the end of an SQL query...
PT-2017-10993
Name of the Vulnerable Software and Affected Versions DTracker version 1.5 Description The issue concerns a lack of input sanitization in the DTracker plugin for WordPress. Specifically, in the file ./dtracker/download.php, user input via the id variable is not properly sanitized before being add...
PT-2017-10994
Name of the Vulnerable Software and Affected Versions DTracker version 1.5 Description The issue concerns a lack of input sanitization in the DTracker plugin. Specifically, user input via the contact id variable is not properly sanitized before being added to an SQL query in the...
PT-2017-10996
Name of the Vulnerable Software and Affected Versions DTracker version 1.5 Description The issue concerns a lack of authorization check in the code, specifically in the dtracker/save mail.php file, which allows unauthorized injection of new contacts into the wp contact table. Recommendations For...
PT-2017-10995
Name of the Vulnerable Software and Affected Versions DTracker version 1.5 Description The issue concerns a lack of authorization check in the DTracker plugin for WordPress. Specifically, the code in dtracker/save contact.php does not verify user authorization before adding new contacts to the wp...
CVE-2017-1002004: Improper Neutralization of Special Elements used in an SQL Command
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query...
WordPress DTracker plugin content injection vulnerability
WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A content injection vulnerability exists in the WordPress DTracker plugin, which stems from the program failing ...
WordPress DTracker plugin content injection vulnerability (CNVD-2017-03798)
WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A content injection vulnerability exists in the WordPress DTracker plugin, which stems from the program failing ...
WordPress Plugin DTracker SQL Injection Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.DTracker is one of the plug-ins used to track site downloads. A SQL injection vulnerability exists in WordPress plugin...
Dtracker <= 1.5 - Unauthorised Contract Creation
Plugin is still affected and has been closed...
WordPress plugin DTracker SQL injection vulnerability (CNVD-2017-03688)
WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language, which supports the setting up of personal blog sites on servers with PHP and MySQL.DTracker is one of the plugins used to track site downloads. A SQL injection vulnerability exists in...