Easy Forms for MailChimp < 6.8.8 - Reflected XSS

The plugin does not sanitise and escape some parameters before outputting them back in the response, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin Make a logged in admin open a page with the following code this requires the attacker to...

WordPress Easy Media Replace Plugin <= 0.1.3 is vulnerable to Arbitrary File Deletion

Software Easy Media Replace Type Plugin Vulnerable versions = 0.1.3 Fixed in 0.2.0 OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2022-46850 Patch priority Medium CVSS severity Medium 8.7 Developer Claim ownership PSID 321ee0c96fa7 Credits Jeong Seong Ho...

Easy Media Replace < 0.2.0 - Author+ File Deletion

The plugin does not validate path of files to be deleted, which could allow users with a role of Author and above to delete files with an allowed extension...

CVE-2023-28660

The Events Made Easy WordPress Plugin, version = 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'searchname' parameter in the emerecurrenceslist action...

Sql injection

The Events Made Easy WordPress Plugin, version = 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'searchname' parameter in the emerecurrenceslist action...

WordPress Plugin Events Made Easy SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL. WordPress plugin is an application plugin. A security vulnerability exists in...

CVE-2023-28660

The Events Made Easy WordPress Plugin, version = 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'searchname' parameter in the emerecurrenceslist action...

PT-2023-21882 · WordPress · Events Made Easy Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Events Made Easy WordPress Plugin version = 2.3.14 Description: The issue is an authenticated SQL injection vulnerability. It affects the search name parameter in the eme recurrences list action. Recommendations: For Events Made Easy WordPres...

CVE-2023-28660

The Events Made Easy WordPress Plugin, version = 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'searchname' parameter in the emerecurrenceslist action...

CVE-2023-28660

CVE-2023-28660 affects the WordPress Events Made Easy plugin (versions ≤ 2.3.14). The vulnerability is an authenticated SQL injection in the eme_recurrences_list action via the search_name parameter, enabling SQLi with the attacker’s authenticated session. CVSSv3 base 8.8 (HIGH) reflects impact o...

CVE-2023-28660: Improper Neutralization of Special Elements used in an SQL Command

The Events Made Easy WordPress Plugin, version = 2.3.14 is affected by an authenticated SQL injection vulnerability in the 'searchname' parameter in the emerecurrenceslist action...

WordPress Easy Table of Contents Plugin <= 2.0.45.2 is vulnerable to Broken Access Control

Software Easy Table of Contents Type Plugin Vulnerable versions = 2.0.45.2 Fixed in 2.0.46 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-25469 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 8f5ee9912e34 Credits Rafshanzani Suhada...

CertWatcher - A Tool For Capture And Tracking Certificate Transparency Logs, Using YAML Templates Based DSL

CertWatcher is a tool for capture and tracking certificate transparency logs, using YAML templates. The tool helps to detect and analyze phishing websites and regular expression patterns, and is designed to make it easy to use for security professionals and researchers. Certwatcher continuously...

WordPress Easy Event calendar Plugin <= 1.0 is vulnerable to Cross Site Scripting (XSS)

Software Easy Event calendar Type Plugin Vulnerable versions = 1.0 Fixed in N/A OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28169 Patch priority Low CVSS severity Low 5.9 Developer Claim ownership PSID 1507887cff23 Credits Nithissh S Required...

Easy!Appointments 代码注入漏洞

Easy!Appointments is a web-based appointment and schedule management system. A code injection vulnerability exists in versions prior to Easy!Appointments 1.5.0, which originates from an HTML injection on the /index.php/backend/settings page...

Easy Forms for MailChimp < 6.8.9 - Admin+ Stored XSS

The plugin does not sanitise and escape some of its from parameters, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup Edit a form and put the following payload i...

GHSA-347F-RXG8-QGRV Easy!Appointments uses hard-coded credentials

Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments 1.4.3 and prior. A patch is available and anticipated to be part of version 1.5.0...

Easy!Appointments uses hard-coded credentials

Use of Hard-coded Credentials in GitHub repository alextselegidis/easyappointments 1.4.3 and prior. A patch is available and anticipated to be part of version 1.5.0...

Easy!Appointments 信任管理问题漏洞

Easy!Appointments is a web-based appointment and schedule management system. A vulnerability with trust management issues exists in versions prior to Easy!Appointments 1.5.0, which stems from the software's use of hard-coded credentials...

HT Easy GA4 ( Google Analytics 4 ) < 1.0.7 - Plugin Activation via CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks...