WordPress Form Maker by 10Web Plugin < 1.15.20 is vulnerable to Arbitrary File Upload

Software Form Maker by 10Web Type Plugin Vulnerable versions 1.15.20 Fixed in 1.15.20 OWASP Top 10 A3: Injection Classification Arbitrary File Upload CVE N/A Patch priority High CVSS severity High 10 Developer Claim ownership PSID 385edba53528 Credits N/A Required privilege Unauthenticated...

CVE-2022-3300

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-3300

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

Sql injection

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-3300 Form Maker by 10Web < 1.15.6 - Admin+ SQLI

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-3300

CVE-2022-3300 affects the WordPress plugin “Form Maker by 10Web” prior to version 1.15.6. The root cause is improper sanitization/escaping of a parameter before it is used in a SQL statement, resulting in a SQL injection. Impact is described as exploitable by high-privilege users such as admins, ...

CVE-2022-3300 Form Maker by 10Web < 1.15.6 - Admin+ SQLI

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

WordPress plugin Form Maker by 10Web SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in the...

CVE-2022-3300: Improper Neutralization of Special Elements used in an SQL Command

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-3300

The Form Maker by 10Web WordPress plugin before 1.15.6 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

Form Maker by 10Web Plugin for WordPress < 1.14.12 Cross-Site Scripting

The WordPress Form Maker by 10Web Plugin installed on the remote host is affected by a stored Cross-Site Scripting XSS. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...

Form Maker by 10Web < 1.15.6 - Admin+ SQLI

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin Create/edit a form, go to the Settings MySQL Mapping i.e...

Form Maker by 10Web < 1.15.6 - Admin+ SQLI

The plugin does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin PoC Create/edit a form, go to the Settings MySQL Mapping i.e /admin.php?page=managefm=editid=1=4id=mapping. Copy the link t...

WordPress Form Maker by 10Web plugin <= 1.15.5 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Nguyen Duy Quoc Khanh in WordPress Form Maker by 10Web plugin versions = 1.15.5 Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.15.6...

CVE-2022-1564

The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1564

The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1564

The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

Cross site scripting

The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1564 Form Maker By 10Web < 1.14.12 - Admin+ Stored Cross-Site Scripting

The Form Maker by 10Web WordPress plugin before 1.14.12 does not sanitize and escape the Custom Text settings, which could allow high privilege user such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...

CVE-2022-1564

CVE-2022-1564 concerns the WordPress Form Maker by 10Web plugin (pre-1.14.12) where the Custom Text settings are not sanitized/escaped, enabling stored Cross-Site Scripting by high-privilege users (e.g., admins) when unfiltered_html is disallowed. Impact described in multiple sources includes an ...