539 matches found
CVE-2019-10866
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function getlabelsparameters in the file form-maker/admin/models/Submissionsfm.php with a crafted value of the /models/Submissioc parameter...
CVE-2019-10866
The CVE-2019-10866 vulnerability affects WordPress Form Maker plugin prior to version 1.13.3. A SQL injection exists in the get_labels_parameters flow inside form-maker/admin/models/Submissions_fm.php, triggered by crafted values (notably via the asc_or_desc parameter in PoC scenarios). Documente...
CVE-2019-10866: Improper Neutralization of Special Elements used in an SQL Command
In the Form Maker plugin before 1.13.3 for WordPress, it's possible to achieve SQL injection in the function getlabelsparameters in the file form-maker/admin/models/Submissionsfm.php with a crafted value of the /models/Submissioc parameter...
PT-2019-12063
Name of the Vulnerable Software and Affected Versions Form Maker plugin versions prior to 1.13.3 Description The issue allows for SQL injection in the get labels parameters function, located in the form-maker/admin/models/Submissions fm.php file, by providing a crafted value for the...
WordPress Form Maker 1.13.3 SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: WordPress Plugin Form Maker 1.13.3 - SQL Injection Exploit Author: Daniele Scanu @ Certimeter Group Vendor Homepage: https://10web.io/plugins/ Software Link: https://wordpress.org/plugins/form-maker/ Version: 1.13.3 Tested on:...
WordPress Plugin Form Maker SQL Injection Vulnerability
WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A SQL injection vulnerability exists in the WordPress plugin Form Maker. An attacker can exploit the vulnerability to obtain sensitive information...
WordPress Form Maker 1.13.3 SQL Injection
Exploit Title: WordPress Plugin Form Maker 1.13.3 - SQL Injection Date: 22-03-2019 Exploit Author: Daniele Scanu @ Certimeter Group Vendor Homepage: https://10web.io/plugins/ Software Link: https://wordpress.org/plugins/form-maker/ Version: 1.13.3 Tested on: Wordpress 5.1 Description: In the Form...
Form Maker by 10Web < 1.13.3 - Authenticated SQL Injection
The Form Maker by 10Web – Mobile-Friendly Drag & Drop Contact Form Builder WordPress plugin was affected by an Authenticated SQL Injection security vulnerability...
WordPress Form Maker Plugin < 1.13.5 CSRF Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2019 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only if description scriptoid"1.3.6.1.4.1.25623.1.0.112573";...
WordPress Contact Form Maker Plugin < 1.13.5 CSRF Vulnerability
The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...
CVE-2019-11590
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the latter is...
CVE-2019-11590
The 10Web Form Maker plugin for WordPress is affected by CVE-2019-11590 (versions
CVE-2019-11590: Improper Limitation of a Pathname to a Restricted Directory
The 10Web Form Maker plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the latter is...
PT-2019-12400
Name of the Vulnerable Software and Affected Versions 10Web Form Maker plugin versions prior to 1.13.5 Description The issue allows for CSRF via the "wp-admin/admin-ajax.php" action parameter, potentially leading to local file inclusion through directory traversal. This is due to a discrepancy...
WordPress Form Maker by 10Web plugin <= 1.13.4 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by Panagiotis Vagenas in WordPress Form Maker by 10Web plugin versions = 1.13.4. Solution Update the WordPress Form Maker by 10Web plugin to the latest available version at least 1.13.5...
WordPress Plugin Contact Form Maker Cross-Site Request Forgery Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the WordPress plugin Contact Form Maker. An attacker can perform a CSRF...
WordPress Form Maker 1.13.2 Cross Site Request Forgery / Local File Inclusion Vulnerabilities
WordPress Form Maker plugin version 1.13.2 suffers from cross site request forgery and local file inclusion vulnerabilities. Title: Form Maker by WD CSRF / LFI Exploit Author: Panagiotis Vagenas Vendor Homepage: http://web-dorado.com/ Software Link: https://wordpress.org/plugins/form-maker Versio...
WordPress Plugin Contact Form Maker 1.13.1 - Cross-Site Request Forgery
WordPress Plugin Contact Form Maker 1.13.1 - Cross-Site Request Forgery Exploit Title: Contact Form by WD CSRF → LFI Date: 2019-03-17 Exploit Author: Panagiotis Vagenas Vendor Homepage: http://web-dorado.com/ Software Link: https://wordpress.org/plugins/contact-form-maker Version: 1.13.1 Tested o...
WordPress Form Maker 1.13.2 Cross Site Request Forgery / Local File Inclusion
Title: Form Maker by WD CSRF → LFI Date: 2019-03-17 Exploit Author: Panagiotis Vagenas Vendor Homepage: http://web-dorado.com/ Software Link: https://wordpress.org/plugins/form-maker Version: 1.13.2 Tested on: WordPress 5.1 Description ----------- Plugin implements the following AJAX actions: -...