CVE-2020-36157

The CVE-2020-36157 entry concerns the WordPress plugin Ultimate Member (before 2.1.12). The issue is an unauthenticated privilege escalation via the role parameter during user registration, caused by insufficient filtering that allows an attacker to supply a WordPress capability (or custom Ultima...

CVE-2020-36157

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a...

CVE-2020-36157

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a...

WordPress Input Validation Error Vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports personal blog sites on servers running PHP and MySQL. A security vulnerability exists in the Ultimate Member plugin before 2.1.12 for WordPress, which stems from...

PT-2021-11937

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin versions prior to 2.1.12 Description: An issue allows authenticated privilege escalation via profile update. Any user with access to the profile.php page can supply the parameter um-role with a value set to any role, su...

PT-2021-11936

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin versions prior to 2.1.12 Description: An issue allows unauthenticated privilege escalation via user meta. An attacker can supply an array parameter for sensitive metadata, such as the wp capabilities user meta that...

Ultimate Member plugin before for WordPress security vulnerability

WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability exists in Ultimate Member plugin before 2.1.12 for WordPress, which can be...

CVE-2020-36156: Improper Privilege Management

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Authenticated Privilege Escalation via Profile Update. Any user with wp-admin access to the profile.php page could supply the parameter um-role with a value set to any role e.g., Administrator during a profile...

PT-2021-11938

Name of the Vulnerable Software and Affected Versions: Ultimate Member plugin versions prior to 2.1.12 Description: The issue is related to unauthenticated privilege escalation via user roles. It occurs due to the lack of filtering on the role parameter that can be supplied during the registratio...

CVE-2020-36157: Undefined Security Weakness

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Roles. Due to the lack of filtering on the role parameter that could be supplied during the registration process, an attacker could supply the role parameter with a...

CVE-2020-36155: Improper Privilege Management

An issue was discovered in the Ultimate Member plugin before 2.1.12 for WordPress, aka Unauthenticated Privilege Escalation via User Meta. An attacker could supply an array parameter for sensitive metadata, such as the wpcapabilities user meta that defines a user's role. During the registration...

WordPress Security Vulnerabilities

WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate Member plugin is one of the plugins used to create membership sites or online communities. A security vulnerability...

CVE-2020-25967

The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...

Sql injection

The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...

CVE-2020-25967

The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...

PT-2020-16258

Name of the Vulnerable Software and Affected Versions fastadmin version 1.0.0.20200506 beta Description The member center function in fastadmin is vulnerable to a Server-Side Template Injection SSTI vulnerability. This issue allows for the injection of templates on the server-side, potentially...

CVE-2020-25967: Improper Neutralization of Special Elements in Output Used by a Downstream Component

The member center function in fastadmin V1.0.0.20200506beta is vulnerable to a Server-Side Template Injection SSTI vulnerability...

Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting

Exploit Title: Invision Community 4.5.4 - 'Field Name' Stored Cross-Site Scripting Date: 02-12-2020 Exploit Author: Hemant Patidar HemantSolo Vendor Homepage: https://invisioncommunity.com/ Software Link: https://invisioncommunity.com/buy Version: 4.5.4 Tested on: Windows 10/Kali Linux CVE:...

CVE-2020-26890

Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into th...

DEBIAN-CVE-2020-26890

Matrix Synapse before 1.20.0 erroneously permits non-standard NaN, Infinity, and -Infinity JSON values in fields of m.room.member events, allowing remote attackers to execute a denial of service attack against the federation and common Matrix clients. If such a malformed event is accepted into th...