369 matches found
CVE-2024-4295-Poc
CVE-2024-4295-Poc CVE-2024-4295 Icegram Express 的 Email Subscribers 插件 editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178 WPHook-applyfilters...
CVE-2024-2876
CVE-2024-2876 漏洞描述： Email Subscribers by Icegram Express – Email Marketing, Newsletters, Automation for WordPress & WooCommerce 插件（适用于 WordPress）在版本 5.7.14 及之前的所有版本中，由于对用户提供的参数转义不足，且未对现有 SQL 查询进行充分预处理，导致通过 IGESSubscribersQuery 类的 run 函数存在 SQL 注入漏洞。这使得未经认证的攻击者能够将额外的 SQL 查询附加到已有查询中，从而提取数据库中的敏感信息。...
CVE-2019-20361-EXPLOIT
CVE-2019-20361-EXPLOIT WordPress 插件 Email Subscribers & Newsletters 4.3.1 之前版本存在一个漏洞，允许通过 hash 参数向数据库传递 SQL 语句（盲 SQL 注入漏洞）。 此脚本是对 exploit-db.com 上由 @KBA@SOGETIESEC 创建的原始脚本的“净化版本”，原始版本在 RaidForums.com 上被净化。 命令 $ git clone https://github.com/jerrylewis9/CVE-2019-20361-EXPLOIT.git $ cd...
CVE-2024-2876
CVE-2024-2876 - Vulnerabilidad de inyección SQL en Email Subscribers by Icegram Express Descripción general CVE-2024-2876 es una vulnerabilidad de seguridad crítica encontrada en el plugin "Email Subscribers by Icegram Express" para WordPress. Esta vulnerabilidad afecta a versiones hasta la 5.7.1...
CVE-2024-4295-Poc
CVE-2024-4295-Poc CVE-2024-4295 Suscriptores de correo electrónico por Icegram Express editsubscriberstatus \email-subscribers\lite\includes\db\class-es-db-lists-contacts.php:616 EmailSubscribersPublic-esemailsubscribeinit \email-subscribers\lite\public\class-email-subscribers-public.php:178...
Email Subscribers & Newsletters <= 5.3.1 - Authenticated SQL Injection
The Email Subscribers & Newsletters WordPress plugin before 5.3.2 does not correctly escape the order and orderby parameters to the ajaxfetchreportlist action, making it vulnerable to blind SQL injection attacks by users with roles as low as Subscriber. Further, it does not have any CSRF protecti...
CVE-2024-2876
CVE-2024-2876 - Vulnerabilidad de Inyección SQL en Email Subscribers by Icegram Express Resumen CVE-2024-2876 es una vulnerabilidad de seguridad crítica encontrada en el plugin "Email Subscribers by Icegram Express" para WordPress. Esta vulnerabilidad afecta a las versiones hasta la 5.7.14...
Email Subscribers by Icegram Express <= 5.7.20 - Unauthenticated SQL Injection via Hash
Email Subscribers by Icegram Express = 5.7.20 contains an unauthenticated SQL injection vulnerability via the hash parameter. id: CVE-2024-4295 info: name: Email Subscribers by Icegram Express = 5.7.20 - Unauthenticated SQL Injection via Hash author: iamnoooob,rootxharsh,pdresearch severity:...
CVE-2022-0439
CVE-2022-0439 CVE-2022-0439 - Email Subscribers & Newsletters 5.3.2 - Inyección SQL ciega de Subscriber+ Requisitos sqlmap instalado y un nombre de usuario y contraseña válidos con subscriber+ Uso root@kitploit: usage: CVE-2022-0439.py -h -w URL -u USERNAME -p PASSWORD options: -h, --help show th...
Wordpress Email Subscribers by Icegram Express - SQL Injection
The Email Subscribers by Icegram Express - Email Marketing, Newsletters, Automation for WordPress & WooCommerce plugin for WordPress is vulnerable to SQL Injection via the 'run' function of the 'IGESSubscribersQuery' class in all versions up to, and including, 5.7.14 due to insufficient escaping ...
wordpress-exploits
wordpress-exploits Exploits aleatorios de WordPress pueden o no funcionar. CVE-2019-19985 Información root@kitploit: Description: Unauthenticated File Download w/ Information Disclosure CVE ID: CVE-2019-19985 CVSS v3.0 Score: 5.8 Medium CVSS Vector String:...
WordPress Email Subscribers & Newsletters plugin <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field vulnerability
Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field vulnerability discovered by Sander Horsman - Conda Security in WordPress Plugin Email Subscribers & Newsletters versions = 5.9.27...
CVE-2026-12757
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
CVE-2026-12757 Email Subscribers & Newsletters <= 5.9.27 - Unauthenticated Arbitrary Shortcode Execution via Subscriber Name Field
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
CVE-2026-12757
The Email Subscribers & Newsletters WordPress plugin is vulnerable to unauthenticated arbitrary shortcode execution in all versions up to and including 5.9.27 . The root cause is that the plugin's subscription-handling logic does not properly validate user-supplied input (the subscriber name fiel...
EUVD-2026-72402
The The Email Subscribers & Newsletters – Email Marketing, Post Notifications & Newsletter Plugin for WordPress plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 5.9.27. This is due to the software allowing users to execute an action that do...
CVE-2026-81290
Unauthenticated Cross Site Scripting XSS in Email Subscribers & Newsletters = 5.9.33 versions...
CVE-2026-81290
CVE-2026-81290 is an unauthenticated Cross Site Scripting (XSS) vulnerability in the WordPress plugin Email Subscribers & Newsletters , affecting versions ≤ 5.9.33 . The vulnerability was discovered by Jiemook and rated CVSS 7.1 (HIGH) with a vector of AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L, indicat...