EUVD-2014-4856

Malware in sbrugna...

CVE-2024-3060

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks...

CVE-2024-3059

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack...

CVE-2014-4939

SQL injection vulnerability in the ENL Newsletter enl-newsletter plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php...

WordPress ENL Newsletter plugin <= 1.0.1 - Admin+ SQL Injection vulnerability

Admin+ SQL Injection vulnerability discovered by Bob Matyas in WordPress Plugin ENL Newsletter versions = 1.0.1...

WordPress ENL Newsletter plugin <= 1.0.1 - Stored XSS via CSRF vulnerability

Stored XSS via CSRF vulnerability discovered by Bob Matyas in WordPress Plugin ENL Newsletter versions = 1.0.1...

CVE-2024-3058

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-3059

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack...

CVE-2024-3060

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks...

CVE-2024-3059

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack...

CVE-2024-3058

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-3060

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks...

CVE-2024-3060 ENL Newsletter <= 1.0.1 - Admin+ SQL Injection

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks...

CVE-2024-3059 ENL Newsletter <= 1.0.1 - Campaign Deletion via CSRF

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack...

CVE-2024-3058 ENL Newsletter <= 1.0.1 - Stored XSS via CSRF

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF check in some places, and is missing sanitisation as well as escaping, which could allow attackers to make logged in admin add Stored XSS payloads via a CSRF attack...

CVE-2024-3059 ENL Newsletter <= 1.0.1 - Campaign Deletion via CSRF

The ENL Newsletter WordPress plugin through 1.0.1 does not have CSRF checks in some places, which could allow attackers to make logged in admins delete arbitrary Campaigns via a CSRF attack...

CVE-2024-3060 ENL Newsletter <= 1.0.1 - Admin+ SQL Injection

The ENL Newsletter WordPress plugin through 1.0.1 does not sanitize and escape a parameter before using it in a SQL statement, allowing admin+ to perform SQL injection attacks...

CVE-2024-3058

The ENL Newsletter WordPress plugin (versions

CVE-2024-3059

The ENL Newsletter WordPress plugin (versions through 1.0.1 ) is vulnerable to Cross-Site Request Forgery (CSRF) due to a lack of CSRF checks in certain parts of the application. This flaw could allow an attacker to trick a logged-in administrator into deleting arbitrary Campaigns . No patch vers...

CVE-2024-3060

The ENL Newsletter WordPress plugin (through version 1.0.1 ) is vulnerable to SQL injection because it fails to properly sanitize and escape a parameter before including it in a SQL statement. This flaw allows users with admin+ privileges to perform SQL injection attacks. No specific remediation ...