301 matches found
CVE-2023-32590
CVE-2023-32590 Subscribe to Category = 2.7.4 - Injection SQL non authentifiée Description Le plugin Subscribe to Category pour WordPress est vulnérable à l'injection SQL dans les versions jusqu'à la 2.7.4 incluse, en raison d'un échappement insuffisant du paramètre fourni par l'utilisateur et d'u...
CVE-2024-1874
CVE-2024-1874 CVE-2024-1874 の概念実証 procopen の配列形式の $command パラメータを介したコマンドインジェクション（CVE-2024-1874 修正の回避） The CVE: PHP バージョン 8.1. の 8.1.29 未満、8.2. の 8.2.20 未満、8.3. の 8.3.8 未満において、CVE-2024-1874 の修正は、コマンド名に末尾のスペースが含まれる場合に機能しません。元の問題: procopen...
CVE-2024-3293-Poc
CVE-2024-3293-Poc rtMedia pour WordPress, BuddyPress et bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...
Relevanssi <= 4.24.4 (Free) - Unauthenticated SQL Injection
The Relevanssi – A Better Search plugin for WordPress is vulnerable to time-based SQL Injection via the cats and tags query parameters in all versions up to, and including, 4.24.4 Free and = 2.27.4 Premium due to insufficient escaping on the user supplied parameter and lack of sufficient...
CVE-2024-24576-PoC
CVE-2024-24576 PoC Command::arg 및 Command::args API는 문서에서 인수가 셸에 의해 해석되지 않고 인수의 내용과 관계없이 생성된 프로세스에 그대로 전달된다고 명시합니다. 이는 신뢰할 수 없는 입력을 인수로 전달해도 안전해야 함을 의미합니다. Windows에서는 이 구현이 다른 플랫폼보다 더 복잡합니다. Windows API는 생성된 프로세스에 전달되는 모든 인수를 포함하는 단일 문자열만 제공하며, 이를 분할하는 것은 생성된 프로세스의 몫이기 때문입니다. 대부분의 프로그램은 표준 C 런타임...
cve-2020-7247
cve-2020-7247 Название эксплойта: OpenSMTPD 6.6.2 - Удаленное выполнение кода. Дата: 2020-01-29. Автор эксплойта: 1F98D. Оригинальный автор: Qualys Security Advisory. Домашняя страница поставщика: https://www.opensmtpd.org/. Ссылка на программное обеспечение:...
CVE-2026-15101
The WPBakery Page Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'data' parameter in all versions up to, and including, 8.7.4 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with subscriber-level...
CVE-2024-3217-POC
CVE-2024-3217-POC Description Mitre Le plugin WP Directory Kit pour WordPress est vulnérable à l'injection SQL via les paramètres 'attributevalue' et 'attributeid' dans toutes les versions jusqu'à la 1.3.0 incluse en raison d'un échappement insuffisant sur le paramètre fourni par l'utilisateur et...
CVE-2026-5513
CVE-2026-5513 https://t.me/FreeToolsCpa CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE-2026-5513 — Bookly ≤ 27.2 Stored XSS via Cookie CVE CVSS Type Auth https://t.me/FreeToolsCpa CVE file In Group Overview Field Value CVE ID CVE-2026-5513 Vulnerability Stored Cross-Site Scripting XSS...
CVE-2026-55673 PowSyBl: Command Injection in LocalCommandExecutor-s
PowSyBl Power System Blocks is a framework to build power system oriented software. Prior to 7.2.2, UnixLocalCommandExecutor and WindowsLocalCommandExecutor concatenate command arguments and environment variables into strings interpreted through bash -c or cmd /c without sufficient escaping...
CVE-2024-55982
CVE-2024-55982 Share Buttons – Social Media = 1.0.2 - SQL Injection non autenticata Descrizione Il plugin Share Buttons – Social Media per WordPress è vulnerabile a SQL Injection nelle versioni fino alla 1.0.2 inclusa, a causa di un escaping insufficiente sul parametro fornito dall'utente e della...
CVE-2024-55978
CVE-2024-55978 Code Generator Pro = 1.2 - Iniezione SQL non autenticata Descrizione Il plugin Code Generator Pro per WordPress è vulnerabile a SQL Injection nelle versioni fino alla 1.2 inclusa, a causa di un escaping insufficiente del parametro fornito dall'utente e della mancanza di una...
CVE-2024-55988
CVE-2024-55988 Navayan CSV Export = 1.0.9 - Nicht authentifizierte SQL-Injection Beschreibung Das Navayan-CSV-Export-Plugin für WordPress ist in Versionen bis einschließlich 1.0.9 anfällig für SQL-Injection, da der vom Benutzer bereitgestellte Parameter unzureichend maskiert wird und die bestehen...
CVE-2026-78468
Rejected reason: REJECT DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2026-78270. Reason: This candidate is a reservation duplicate of CVE-2026-78270. Notes: All CVE users should reference CVE-2026-78270 instead of this candidate. All references and descriptions in this candidate have been...
EUVD-2026-65579
The FluentCRM Pro – Email Newsletter, Automation, Email Marketing, Email Campaigns, Optins, Leads, and CRM Solution plugin for WordPress is vulnerable to SQL Injection in all versions up to, and including, 3.1.12 due to insufficient escaping on the user supplied parameter and lack of sufficient...
EUVD-2026-65459
The Media Sweep – WordPress Media Cleaner plugin for WordPress is vulnerable to generic SQL Injection via the 'fields' parameter in all versions up to, and including, 1.1.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. Th...
CVE-2026-77824
Media Sweep – WordPress Media Cleaner (all versions up to and including 1.1.3 ) is affected by a SQL Injection vulnerability in the 'fields' parameter of its REST API. The root cause is insufficient escaping of the user-supplied parameter combined with lack of proper query preparation, as seen in...
