WordPress Paid Memberships Pro plugin <= 2.5.2 - Insecure Direct Object Reference & sensitive information disclosure vulnerability

Insecure Direct Object Reference & sensitive information disclosure vulnerability found in WordPress Paid Memberships Pro plugin versions = 2.5.2. Solution Update the WordPress Paid Memberships Pro plugin to the latest available version at least 2.5.3...

Azure AD. Attack of the Default Config

Uncloaking dangerous and default configurations within Azure. TL; DR There are several default configurations within the admin portal of Azure. The main affected area is Azure Active Directory Azure AD which is the primary area that controls user authentication, group memberships and privileges...

WordPress Paid Memberships Pro plugin <= 2.5 - Authenticated Cross-Site Scripting (XSS) vulnerability

Authenticated Cross-Site Scripting XSS vulnerability found by Ron Masas from Checkmarx in WordPress Paid Memberships Pro plugin versions = 2.5. Solution Update the WordPress Paid Memberships Pro plugin to the latest available version at least 2.5.1...

Paid Memberships Pro < 2.5.1 - Authenticated Cross-Site Scripting (XSS)

The Paid Memberships Pro WordPress plugin, versions less than 2.5.1, were affected by an Authenticated Cross-Site Scripting XSS vulnerability in the 'page ' paramater of the Members List page of the dashboard...

WordPress Paid Memberships Pro plugin <= 2.4.2 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found by Jerome Bruandet NinTechNet in WordPress Paid Memberships Pro plugin versions = 2.4.2. Solution Update the WordPress Paid Memberships Pro plugin to the latest available version at least 2.4.3...

CVE-2020-5579

SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors...

CVE-2020-5579

SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors...

Sql injection

SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors...

CVE-2020-5579

CVE-2020-5579 concerns the WordPress plugin Paid Memberships Pro (versions prior to 2.3.3). The vulnerability is a SQL injection (CWE-89) that can be exploited by an attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors on the admin-facing interface. Several...

CVE-2020-5579

SQL injection vulnerability in the Paid Memberships versions prior to 2.3.3 allows attacker with administrator rights to execute arbitrary SQL commands via unspecified vectors...

WordPress Plugin "Paid Memberships Pro" vulnerable to SQL injection

Overview WordPress Plugin "Paid Memberships Pro" contains an SQL injection vulnerability CWE-89. Kenichi Okuno of Mitsui Bussan Secure Directions, Inc reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership. Impact An...

Paid Memberships Pro < 2.3.3 - Authenticated SQL Injection

A high privileged user administrator could perform SQL injection attacks when adding new orders in the dashboard...

WordPress Paid Memberships Pro plugin <= 2.3.2 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Kenichi Okuno in WordPress Paid Memberships Pro plugin versions = 2.3.2. Solution Update the WordPress Paid Memberships Pro plugin to the latest available version at least 2.3.3...

JVN#20248858: WordPress Plugin "Paid Memberships Pro" vulnerable to SQL injection

WordPress Plugin "Paid Memberships Pro" contains an SQL injection vulnerability CWE-89. Impact An attacker who can access the administrative page of Paid Membership Pro may obtain and/or alter the information stored in the database. Solution Update the plugin Update the plugin according to the...

CVE-2020-5502

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships...

Cross site request forgery (csrf)

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships...

CVE-2020-5502

The CVE-2020-5502 entry concerns phpBB 3.2.8, where a cross-site request forgery (CSRF) vulnerability could approve pending group memberships. The connected documents corroborate the same issue across multiple feeds (Red Hat, OSV, GHSA, CNVD, NVD, and other vulnerability trackers) without providi...

CVE-2020-5502

phpBB 3.2.8 allows a CSRF attack that can approve pending group memberships...

PT-2020-18483 · Phpbb Limited · Phpbb

Name of the Vulnerable Software and Affected Versions: phpBB version 3.2.8 Description: The issue allows for a CSRF attack, enabling the approval of pending group memberships without proper authorization. Recommendations: For phpBB version 3.2.8, update to a newer version that contains a fix for...

WordPress Paid Memberships Pro plugin <= 2.0.5 - Authenticated Open Redirect vulnerability

Authenticated Open Redirect vulnerability found in WordPress Paid Memberships Pro plugin versions = 2.0.5. Solution Update the WordPress Paid Memberships Pro plugin to the latest available version at least 2.0.6...