Sql injection

The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user...

Cross site scripting

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2021-24755 myCred < 2.3 - Subscriber+ SQL Injection

The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user...

CVE-2021-24755

The myCred WordPress plugin version before 2.3 is vulnerable to an SQL injection vulnerability. The root cause is a failure to properly validate or escape the fields parameter before incorporating it into a SQL statement. This flaw allows any authenticated user to execute unauthorized SQL command...

CVE-2017-20008 myCRED < 1.7.8 - Reflected Cross-Site Scripting

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting...

CVE-2017-20008

Summary of CVE-2017-20008 : The WordPress plugin myCred (versions prior to 1.7.8) fails to sanitize and escape the user parameter before echoing it back in the Points Log admin dashboard, causing a reflected Cross-Site Scripting (XSS) vulnerability. Root cause: user input is not properly sanitize...

CVE-2021-24755: Improper Neutralization of Special Elements used in an SQL Command

The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user...

CVE-2017-20008: Improper Neutralization of Input During Web Page Generation

The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log admin dashboard, leading to a Reflected Cross-Site Scripting...

PT-2021-8575

Name of the Vulnerable Software and Affected Versions myCred WordPress plugin versions prior to 1.7.8 Description The issue is related to a Reflected Cross-Site Scripting problem. It occurs because the user parameter is not properly sanitised and escaped before being outputted in the Points Log...

PT-2021-16256

Name of the Vulnerable Software and Affected Versions: myCred WordPress plugin versions prior to 2.3 Description: The issue concerns an SQL injection that occurs because the fields parameter is not validated or escaped before being used in a SQL statement. This can be exploited by any authenticat...

WordPress和WordPress 插件 SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Plugin is an open source application plugin for WordPress. The WordPress myCred plugin suffers from a SQ...

WordPress 插件跨站脚本漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an open source application plugin for WordPress. A cross-site scripting vulnerability exists in versio...

myCred < 2.3 - Subscriber+ SQL Injection

The plugin does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user any authenticated user...

WordPress myCred plugin <= 2.2 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by bl4derunner in WordPress myCred plugin versions = 2.2. Solution Update the WordPress myCred plugin to the latest available version at least 2.3...

myCred < 2.3 - Subscriber+ SQL Injection

The plugin does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user PoC any authenticated user...

VulnCheck KEV: CVE-2021-24755

The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated user...

WordPress myCred plugin <= 1.7.7 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability discovered by Jeremie Amsellem in WordPress myCred plugin versions = 1.7.7. Solution Update the WordPress myCred plugin to the latest available version at least 1.7.8...