CVE-2022-0426

CVE-2022-0426 affects WordPress Product Feed PRO for WooCommerce plugin versions before 11.2.3. The vulnerability arises because the rowCount parameter is not escaped before being echoed in the woosea_categories_dropdown AJAX action, which is available to any authenticated user, enabling reflecte...

CVE-2022-26485

creationtimestamp| type| source ---|---|--- 2022-03-07 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=749 2022-03-07 05:42:50+00:00| exploited| https://t.me/thehackernews/1952 2022-03-07 06:12:15+00:00| seen| https://t.me/cKure/8957 2022-11-17 10:42:44+00:00| exploited|...

WordPress plugin Tradetracker-Store SQL注入漏洞

WordPress is the Wordpress Foundation's suite of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on PHP and MySQL servers. WordPress Tradetracker-Store has a SQL injection vulnerability, which stems from the fact that the test parameters o...

WordPress plugin 跨站脚本漏洞

WordPress is a set of blogging platforms developed using the PHP language by the Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Product Feed PRO for WooCommerce Plugin before 11.2.3...

WordPress Drip Feed Content Extended for Learndash plugin <= 1.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Drip Feed Content Extended for Learndash plugin versions = 1.1. Solution No patched version available...

WordPress WordPress Expert Agent XML Feed plugin <= 2.1.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WordPress Expert Agent XML Feed plugin versions = 2.1.3. Solution No patched version available...

WordPress Auto Robot – WP Autoblogging and RSS Feed News Aggregator plugin < 3.3.40 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Auto Robot – WP Autoblogging and RSS Feed News Aggregator plugin versions 3.3.40. Solution Update the WordPress Auto Robot – WP Autoblogging and RSS Feed News Aggregator plugin to the latest available...

WordPress Pretty Grid – Social Feed Gallery Plugin plugin < 1.0.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Pretty Grid – Social Feed Gallery Plugin plugin versions 1.0.8. Solution Update the WordPress Pretty Grid – Social Feed Gallery Plugin plugin to the latest available version at least 1.0.8...

WordPress Easy Tiktok Feed plugin <= 1.1.0 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Easy Tiktok Feed plugin versions = 1.1.0. Solution Update the WordPress Easy Tiktok Feed plugin to the latest available version at least 1.1.1...

WordPress Easy Social Feed plugin <= 6.3.3 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Easy Social Feed plugin versions = 6.3.3. Solution Update the WordPress Easy Social Feed plugin to the latest available version at least 6.3.4...

WordPress Easy Social Feed plugin <= 6.3.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Easy Social Feed plugin versions = 6.3.3. Solution Update the WordPress Easy Social Feed plugin to the latest available version at least 6.3.4...

WordPress WordPress Expert Agent XML Feed plugin <= 2.1.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress WordPress Expert Agent XML Feed plugin versions = 2.1.3. Solution No patched version available...

WordPress RSS feed with featured images | RSS Chimp plugin <= 1.2.1 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress RSS feed with featured images | RSS Chimp plugin versions = 1.2.1. Solution Update the WordPress RSS feed with featured images | RSS Chimp plugin plugin to the latest available version at least 1.2.2...

WordPress Easy Tiktok Feed plugin <= 1.1.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Easy Tiktok Feed plugin versions = 1.1.0. Solution Update the WordPress Easy Tiktok Feed plugin to the latest available version at least 1.1.1...

WordPress Embed Tik Tok Video Feed (Tiktok feed) for WordPress plugin <= 1.0.3 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Embed Tik Tok Video Feed Tiktok feed for WordPress plugin versions = 1.0.3. Solution No patched version available...

WordPress Pretty Grid – Social Feed Gallery Plugin plugin < 1.0.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Pretty Grid – Social Feed Gallery Plugin plugin versions 1.0.8. Solution Update the WordPress Pretty Grid – Social Feed Gallery Plugin plugin to the latest available version at least 1.0.8...

WordPress RSS feed with featured images | RSS Chimp plugin <= 1.2.1 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress RSS feed with featured images | RSS Chimp plugin versions = 1.2.1. Solution Update the WordPress RSS feed with featured images | RSS Chimp plugin plugin to the latest available version at least 1.2.2...

ruby: HTTP response splitting in WEBrick

Ruby through 2.4.7, 2.5.x through 2.5.6, and 2.6.x through 2.6.4 allows HTTP Response Splitting. If a program using WEBrick inserts untrusted input into the response header, an attacker can exploit it to insert a newline character to split a header, and inject malicious content to deceive clients...

A flaw was found in Python specifically within the urllib.parse module. This module helps break Uniform Resource Locator (URL) strings into components. The issue involves how the urlparse method does not sanitize input and allows characters like '\r' and '\n' in the URL path. This flaw allows an attacker to input a crafted URL leading to injection attacks. This flaw affects Python versions prior to 3.10.0b1 3.9.5 3.8.11 3.7.11 and 3.6.14.

...

CVE-2022-0609

creationtimestamp| type| source ---|---|--- 2022-02-15 04:00:00+00:00| seen| https://www.govcert.gov.hk/en/alertsdetail.php?id=740 2022-02-15 09:13:49+00:00| exploited| https://t.me/truesecator/2628 2022-02-15 09:14:28+00:00| exploited| https://t.me/NeKaspersky/1810 2022-02-15 19:47:37+00:00|...