212 matches found
CVE-2022-35242
Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin = 3.4.1 at WordPress...
Code injection
Unauthenticated plugin settings change vulnerability in 59sec THE Leads Management System: 59sec LITE plugin = 3.4.1 at WordPress...
CVE-2022-35242
CVE-2022-35242 affects the WordPress plugin 59sec LITE (THE Leads Management System) version
Cross-Site Request Forgery (CSRF)
Description CSRF is still possible on the Leads module Detailed Video is attached Proof of concept. Tested from: Firefox URL of Demo : https://demo.corebos.com/index.php?module=Leads&action=index&record=&relmodule=Leads Proof of Concept Video Link : https://vimeo.com/732211543 Steps Involved 1...
Malicious code in gestor-leads (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc22bb8368a38cfef8abeb2671050e203f811bf367b3b96987ff59feab5febc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
MAL-2022-3348 Malicious code in gestor-leads (npm)
--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc22bb8368a38cfef8abeb2671050e203f811bf367b3b96987ff59feab5febc2 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...
SUSE: Security Advisory (SUSE-SU-2022:1920-1)
The remote host is missing an update for the SPDX-FileCopyrightText: 2022 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...
CVE-2022-0657
The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtnggdeleteleads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection...
CVE-2022-0657
The 5 Stars Rating Funnel WordPress Plugin | RRatingg WordPress plugin before 1.2.54 does not properly sanitise, validate and escape lead ids before using them in a SQL statement via the rrtnggdeleteleads AJAX action, available to unauthenticated users, leading to an unauthenticated SQL injection...
WordPress Chat Button- Leads and Order over Chat plugin <= 1.6.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Chat Button- Leads and Order over Chat plugin versions = 1.6.0. Solution Update the WordPress Chat Button- Leads and Order over Chat plugin to the latest available version at least 1.6.1...
Contact Form & Lead Form Elementor Builder < 1.6.8 - Subscriber+ Arbitrary Lead Deletion
The plugin does not have capability and CSRF checks in the deleteleadsbackend AJAX action, available to any authenticated users. As a result, users with a role as low as subscriber could delete arbitrary Leads. Attackers could also make any logged in users delete leads via a CSRF attack PoC POST...
CVE-2021-39198
OroCRM is an open source Client Relationship Management CRM application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery CSRF attack. There are no workarounds that address this vulnerability and all...
Cross site request forgery (csrf)
OroCRM is an open source Client Relationship Management CRM application. Affected versions we found to suffer from a vulnerability which could an attacker is able to disqualify any Lead with a Cross-Site Request Forgery CSRF attack. There are no workarounds that address this vulnerability and all...
Sugarcrm SugarCRM Cross Site Scripting Vulnerability
Sugarcrm SugarCRM is an open source Customer Relationship Management CRM system from SugarCRM Sugarcrm, USA. The system supports differentiated marketing, management and distribution of sales leads for different customer needs, and information sharing and tracking of sales representatives. SugarC...
Leads-5050 Visitor Insights < 1.0.4 - Unauthenticated License Change
The leads5050setlicense AJAX action was available to unauthenticated users allowing them to set an arbitrary license in the plugins settings POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-GB,en;q=0.5 Accept-Encoding: gzip,...
Leads-5050 Visitor Insights < 1.1.0 - Unauthorised License Change
The leads5050setlicense AJAX action is available to authenticated users, but is missing any capability and CSRF checks. This could allow any low privilege users subscriber+ to set an arbitrary license in the plugins settings PoC POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Accept:...
Leads-5050 Visitor Insights < 1.0.4 - Unauthenticated License Change
The leads5050setlicense AJAX action was available to unauthenticated users allowing them to set an arbitrary license in the plugins settings PoC POST /wordpress/wp-admin/admin-ajax.php HTTP/1.1 Accept: application/json, text/javascript, /; q=0.01 Accept-Language: en-GB,en;q=0.5 Accept-Encoding:...
WordPress Leads 5050 Visitor Insights plugin <= 1.0.5 - Unauthorized License Change vulnerability
Unauthorized License Change vulnerability discovered by WPScan Team in WordPress Leads 5050 Visitor Insights plugin versions = 1.0.5. Solution Update the WordPress Leads 5050 Visitor Insights plugin to the latest available version at least 1.1.0...
Wordpress plugin Controlled Admin Access 访问控制错误漏洞
WordPress Plugin is an open source application plugin for WordPress. A security vulnerability exists in multiple Wordpress plugins that allows an attacker to use this endpoint to add arbitrary data to predefined options in the wpoptions table. The following products and versions are affected: The...
WordPress Thrive Leads Version premium plugin <= 2.3.9.3 - Unauthenticated Option Update vulnerability
Unauthenticated Option Update vulnerability discovered by WordFence in WordPress Thrive Leads Version premium plugin versions = 2.3.9.3. Solution Update the WordPress Thrive Leads Version premium plugin to the latest available version at least 2.3.9.4...