WordPress Dokan Plugin <= 3.7.19 is vulnerable to PHP Object Injection

Software Dokan Type Plugin Vulnerable versions = 3.7.19 Fixed in 3.7.20 OWASP Top 10 A8: Insecure Deserialization Classification PHP Object Injection CVE CVE-2023-34382 Patch priority Medium CVSS severity Medium 4.4 Developer Claim ownership PSID e06401ebc804 Credits Theodoros Malachias Required...

WordPress Dokan Plugin <= 3.7.12 is vulnerable to SQL Injection

Software Dokan Type Plugin Vulnerable versions = 3.7.12 Fixed in 3.7.13 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-26525 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 3c9e33e0d441 Credits Rafie Muhammad Patchstack Required privilege Vendor...

CVE-2022-3915

The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

Sql injection

The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2022-3915 Dokan < 3.7.6 - Unauthenticated SQLi

The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2022-3915 Dokan < 3.7.6 - Unauthenticated SQLi

The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

CVE-2022-3915

CVE-2022-3915 affects the Dokan WordPress plugin prior to 3.7.6. The issue is an unauthenticated SQL injection caused by improper sanitisation/escaping of a parameter before it is used in a SQL statement. Impact is high (C/H, I/H, A/H) with network attack vector and no user interaction required. ...

CVE-2022-3915 Dokan < 3.7.6 - Unauthenticated SQLi

The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

WordPress plugin Dokan SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerability exist...

CVE-2022-3915: Undefined Security Weakness

The Dokan WordPress plugin before 3.7.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users...

PT-2022-24773

Name of the Vulnerable Software and Affected Versions Dokan WordPress plugin versions prior to 3.7.6 Description The issue is related to a SQL injection that can be exploited by unauthenticated users due to improper sanitization and escaping of a parameter in a SQL statement. Recommendations For...

Dokan < 3.7.6 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users Setup: - Install WooCommerce dependency, no setup required - Install the plugin, complete the wizard no special configuration was...

Dokan < 3.7.6 - Unauthenticated SQLi

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by unauthenticated users PoC Setup: - Install WooCommerce dependency, no setup required - Install the plugin, complete the wizard no special configuration was...

Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting

The plugin allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators. As a vendor, add a review in any products with following payload: https://youtu.be/gGUNSG5s5JU...

Dokan < 3.6.4 - Vendor Stored Cross-Site Scripting

The plugin allows vendors to inject arbitrary javascript in product reviews, which may allow them to run stored XSS attacks against other users like site administrators. PoC As a vendor, add a review in any products with following payload: https://youtu.be/gGUNSG5s5JU...

WordPress Dokan plugin <= 3.2.0 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by NintechNet in WordPress Dokan plugin versions = 3.2.0. Solution Update the WordPress Dokan plugin to the latest available version at least 3.2.1...

WordPress Dokan plugin <= 3.0.8 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Jerome Bruandet NinTechNet in WordPress Dokan plugin versions = 3.0.8. Solution Update the WordPress Dokan plugin to the latest available version at least 3.0.9...

CVE-2018-5410 Dokan file system driver contains a stack-based buffer overflow

Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.500...

CVE-2018-5410

Dokan/Dokany’s dokan1.sys driver (Dokan versions 1.0.0.5000–1.2.0.1000) contains a stack-based buffer overflow. An attacker who can open a device handle can send crafted input to overflow the kernel stack, enabling local privilege escalation. The issue was introduced in 1.0.0.5000. A fix is avail...

CVE-2018-5410

Dokan, versions between 1.0.0.5000 and 1.2.0.1000, are vulnerable to a stack-based buffer overflow in the dokan1.sys driver. An attacker can create a device handle to the system driver and send arbitrary input that will trigger the vulnerability. This vulnerability was introduced in the 1.0.0.500...