CVE-2024-7864

The Favicon Generator CLOSED WordPress plugin before 2.1 does not have CSRF and path validation in the outputsubadminpage0 function, allowing attackers to make logged in admins delete arbitrary files on the server...

CVE-2024-7863

The Favicon Generator CLOSED WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server...

CVE-2024-7863

The Favicon Generator CLOSED WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server...

CVE-2024-7863

The CVE-2024-7863 entry concerns the Favicon Generator (CLOSED) WordPress plugin prior to version 2.1. The vulnerability arises from lack of validation for uploaded files and missing CSRF protection, enabling a logged-in admin to upload arbitrary files (potentially PHP) to the server. Public sour...

CVE-2024-7864 Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF

The Favicon Generator CLOSED WordPress plugin before 2.1 does not have CSRF and path validation in the outputsubadminpage0 function, allowing attackers to make logged in admins delete arbitrary files on the server...

CVE-2024-7864

The CVE concerns the WordPress Favicon Generator plugin (versions prior to 2.1). A lack of CSRF protection and insufficient path validation in the output_sub_admin_page_0() function allows an attacker to induce logged-in admins to delete arbitrary files on the server. Impact is high for integrity...

CVE-2024-7864 Favicon Generator < 2.1 - Arbitrary File Deletion via CSRF

The Favicon Generator CLOSED WordPress plugin before 2.1 does not have CSRF and path validation in the outputsubadminpage0 function, allowing attackers to make logged in admins delete arbitrary files on the server...

CVE-2024-7863 Favicon Generator < 2.1 - Arbitrary File Upload via CSRF

The Favicon Generator CLOSED WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server...

CVE-2024-7863 Favicon Generator < 2.1 - Arbitrary File Upload via CSRF

The Favicon Generator CLOSED WordPress plugin before 2.1 does not validate files to be uploaded and does not have CSRF checks, which could allow attackers to make logged in admin upload arbitrary files such as PHP on the server...

WordPress plugin Favicon Generator 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

WordPress plugin Favicon Generator 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plug-in. A security...

PT-2024-38641 · WordPress · The Favicon Generator

Name of the Vulnerable Software and Affected Versions: The Favicon Generator CLOSED WordPress plugin versions prior to 2.1 Description: The issue concerns a lack of CSRF and path validation in the output sub admin page 0 function. This allows attackers to make logged-in admins delete arbitrary...

PT-2024-38640 · WordPress · The Favicon Generator

Name of the Vulnerable Software and Affected Versions: The Favicon Generator CLOSED WordPress plugin versions prior to 2.1 Description: The issue concerns a lack of file validation for uploads and missing CSRF checks. This could allow attackers to make logged-in admins upload arbitrary files, suc...

The vulnerability of the file loading function in the “Change Favicon” interface of the Versa Director software platform for managing network infrastructure allows a hacker to gain increased privileges.

The vulnerability of the file loading function in the “Change Favicon of the software platform for managing network infrastructure Versa Director” interface relates to the unlimited loading of dangerous types of files. Exploiting this vulnerability could allow a malicious actor to enhance their...

WordPress Favicon Generator plugin < 2.1 - Arbitrary File Upload via CSRF vulnerability

Arbitrary File Upload via CSRF vulnerability discovered by Daniel Ruf in WordPress Plugin Favicon Generator versions 2.1...

WordPress Favicon Generator Plugin < 2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Favicon Generator Type Plugin Vulnerable versions 2.1 Fixed in 2.1 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7863 Patch priority Low CVSS severity Low 9.6 Developer Claim ownership PSID 2e8a0fbb5efb Credits Daniel Ruf Required...

WordPress Favicon Generator plugin <= 1.5 - Cross-Site Request Forgery to Arbitrary File Deletion vulnerability

Cross-Site Request Forgery to Arbitrary File Deletion vulnerability discovered by Marco Wotschka in WordPress Plugin Favicon Generator versions = 1.5...

WordPress Favicon Generator Plugin <= 1.5 is vulnerable to Cross Site Request Forgery (CSRF)

Software Favicon Generator Type Plugin Vulnerable versions = 1.5 Fixed in 2.1 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-7568 Patch priority Low CVSS severity Low 9.6 Developer Claim ownership PSID bbcc46bd3f4f Credits Marco Wotschka Require...

CVE-2024-7568

The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the outputsubadminpage0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on...

CVE-2024-7568

The Favicon Generator plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the outputsubadminpage0 function. This makes it possible for unauthenticated attackers to delete arbitrary files on...