WordPress Ultimate Membership Pro Plugin <= 12.7 is vulnerable to Privilege Escalation

Software Ultimate Membership Pro Type Plugin Vulnerable versions = 12.7 Fixed in 12.8 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-43240 Patch priority High CVSS severity High 9.4 Developer Claim ownership PSID cfa9ba3d1675 Credits...

Live Membership System 安全漏洞

Live Membership System is a live membership system by rashmi mishra individual developer. A security vulnerability exists in Live Membership System v1.0, which stems from a stored cross-site scripting XSS vulnerability found in /viewtype.php...

CVE-2024-7649

CVE-2024-7649 (Opal Membership, WordPress) : Stored XSS in checkout form fields across all versions up to and including 1.2.4 due to insufficient input sanitization and output escaping. Unauthenticated attackers could inject scripts that run when users load injected pages. No public remediation d...

CVE-2024-7649 Opal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting

The Opal Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via checkout form fields in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-7649 Opal Membership <= 1.2.4 - Unauthenticated Stored Cross-Site Scripting

The Opal Membership plugin for WordPress is vulnerable to Stored Cross-Site Scripting via checkout form fields in all versions up to, and including, 1.2.4 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scrip...

CVE-2024-7648 Opal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure

The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the private notes functionality on payments which utilizes WordPress comments. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-7648 Opal Membership <= 1.2.4 - Authenticated (Subscriber+) Information Disclosure

The Opal Membership plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.2.4 via the private notes functionality on payments which utilizes WordPress comments. This makes it possible for authenticated attackers, with subscriber-level access...

CVE-2024-7648

CVE-2024-7648 affects the Opal Membership plugin for WordPress. The vulnerability allows Sensitive Information Exposure in all versions up to 1.2.4 through the private notes feature on payments that uses WordPress comments. As a result, authenticated users with subscriber-level access or higher c...

PT-2024-38479 · WordPress · Opal Membership

Name of the Vulnerable Software and Affected Versions: Opal Membership plugin for WordPress versions up to and including 1.2.4 Description: The issue allows authenticated attackers with subscriber-level access and above to view private notes that should be restricted to administrators. This is...

PT-2024-28871 · Unknown · Kashipara Live Membership System

Name of the Vulnerable Software and Affected Versions: Kashipara Live Membership System version 1.0 Description: A SQL injection vulnerability in the "/index.php" page of Kashipara Live Membership System allows remote attackers to execute arbitrary SQL commands and bypass login via the email or...

CVE-2024-40482

An Unrestricted file upload vulnerability was found in "/Membership/editmember.php" of Kashipara Live Membership System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2024-40482

CVE-2024-40482 affects Kashipara Live Membership System v1.0. An unrestricted file upload in "/Membership/edit_member.php" enables attackers to upload a crafted PHP file and achieve arbitrary code execution. The CVSS basis is 9.8 (CRITICAL): Network access, no authentication, low attack complexit...

CVE-2024-40486

A SQL injection vulnerability in "/index.php" of Kashipara Live Membership System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email or password Login parameters...

CVE-2024-40486

A SQL injection vulnerability in "/index.php" of Kashipara Live Membership System v1.0 allows remote attackers to execute arbitrary SQL commands and bypass Login via the email or password Login parameters...

CVE-2024-40487

Kashipara Live Membership System v1.0 is affected by a Stored XSS in the /view_type.php endpoint, exploitable via the membershipType parameter to trigger arbitrary code execution. The issue is documented across multiple sources (NVD/Red Hat/CVE lists and security reports) with a CVSSv3.1 base sco...

CVE-2024-40488

CVE-2024-40488 affects the Kashipara Live Membership System v1.0. A CSRF flaw could trick an administrator into deleting valid member data via a crafted request to /delete_members.php. The CVE is rated high (CVSS 3.1: 8.8) with attacker-initial access not requiring privileges and user interaction...

CVE-2024-40488

A Cross-Site Request Forgery CSRF vulnerability was found in the Kashipara Live Membership System v1.0. This could lead to an attacker tricking the administrator into deleting valid member data via a crafted HTML page, as demonstrated by a Delete Member action at the /deletemembers.php...

PT-2024-28872 · Unknown · Kashipara Live Membership System

Name of the Vulnerable Software and Affected Versions: Kashipara Live Membership System version 1.0 Description: A Stored Cross Site Scripting XSS issue was found in the "/view type.php" endpoint, which allows remote attackers to execute arbitrary code via the membershipType parameter...

CVE-2024-40482

An Unrestricted file upload vulnerability was found in "/Membership/editmember.php" of Kashipara Live Membership System v1.0, which allows attackers to execute arbitrary code via uploading a crafted PHP file...

CVE-2024-40488

A Cross-Site Request Forgery CSRF vulnerability was found in the Kashipara Live Membership System v1.0. This could lead to an attacker tricking the administrator into deleting valid member data via a crafted HTML page, as demonstrated by a Delete Member action at the /deletemembers.php...