886 matches found
CVE-2024-7380
The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajaxgeolocatemenu and ajaxgeolocateremovemenu functions in all versions up to, and including, 8.6.9. This makes it possible for authenticated attackers, with...
CVE-2024-7380
The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajaxgeolocatemenu and ajaxgeolocateremovemenu functions in all versions up to, and including, 8.7.3. This makes it possible for authenticated attackers, with...
CVE-2024-7381 Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution
The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajaxshortcodecache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary...
CVE-2024-7381 Geo Controller <= 8.6.9 - Missing Authorization to Unauthenticated Shortcode Execution
The Geo Controller plugin for WordPress is vulnerable to unauthorized shortcode execution due to missing authorization and capability checks on the ajaxshortcodecache function in all versions up to, and including, 8.6.9. This makes it possible for unauthenticated attackers to execute arbitrary...
CVE-2024-7381
CVE-2024-7381 : The WordPress plugin Geo Controller is vulnerable to unauthenticated shortcode execution due to missing authorization and capability checks on the ajax__shortcode_cache function in all versions up to and including 8.6.9. This allows unauthenticated attackers to execute arbitrary s...
CVE-2024-7380 Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion
The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajaxgeolocatemenu and ajaxgeolocateremovemenu functions in all versions up to, and including, 8.7.3. This makes it possible for authenticated attackers, with...
CVE-2024-7380 Geo Controller <= 8.7.3 - Missing Authorization to Authenticated (Subscriber+) Menu Creation/Deletion
The Geo Controller plugin for WordPress is vulnerable to unauthorized menu creation/deletion due to missing capability checks on the ajaxgeolocatemenu and ajaxgeolocateremovemenu functions in all versions up to, and including, 8.7.3. This makes it possible for authenticated attackers, with...
CVE-2024-7380
CVE-2024-7380 — Geo Controller (WordPress) security issue : The Geo Controller plugin (WordPress) up to and including version 8.6.9 is vulnerable to unauthorized menu creation/deletion due to missing capability checks in ajax__geolocate_menu and ajax__geolocate_remove_menu. Affected product: Geo ...
WordPress Geo Controller plugin <= 8.7.3 - Multiple Missing Authorization vulnerability
Multiple Missing Authorization vulnerability discovered by Lucio Sá in WordPress Plugin Geo Controller versions = 8.7.3...
PT-2024-38310 · WordPress · Geo Controller
Name of the Vulnerable Software and Affected Versions: Geo Controller plugin for WordPress versions up to, and including, 8.6.9 Description: The issue arises from missing capability checks on the ajax geolocate menu and ajax geolocate remove menu functions, allowing authenticated attackers with...
WordPress plugin Geo Controller 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress plugin Geo Controller 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress Geo Controller Plugin <= 8.7.3 is vulnerable to Broken Access Control
Software Geo Controller Type Plugin Vulnerable versions = 8.7.3 Fixed in 8.7.4 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-7380 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID c241dd8210b8 Credits Lucio Sá Required privilege...
WordPress GEO my WordPress plugin < 4.5.0.2 - Unauthenticated LFI to RCE/PHAR Deserialization vulnerability
Unauthenticated LFI to RCE/PHAR Deserialization vulnerability discovered by Michael Dyrna in WordPress Plugin GEO my WordPress versions 4.5.0.2...
CVE-2024-6330
The GEO my WP WordPress plugin before 4.5.0.2 does not prevent unauthenticated attackers from including arbitrary files in PHP's execution context, which leads to Remote Code Execution...
CVE-2024-6330
The CVE-2024-6330 entry concerns GEO my WP WordPress plugin prior to version 4.5.0.2. The vulnerability is an unauthenticated Local File Inclusion that allows attackers to cause Remote Code Execution by including arbitrary files in PHP’s execution context. Affected software is specifically GEO my...
WordPress GEO my WordPress Plugin < 4.5.0.2 is vulnerable to Local File Inclusion
Software GEO my WordPress Type Plugin Vulnerable versions 4.5.0.2 Fixed in 4.5.0.2 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2024-6330 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 1d2a75d492b7 Credits Michael Dyrna Required privilege...
WordPress plugin GEO my WordPress 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
PT-2024-37545 · WordPress · Geo My Wp
Name of the Vulnerable Software and Affected Versions: GEO my WP WordPress plugin versions prior to 4.5.0.2 Description: The issue allows unauthenticated attackers to include arbitrary files in PHP's execution context, leading to Remote Code Execution. This can be exploited by including malicious...
