173 matches found
CVE-2021-24371
CVE-2021-24371 affects the RSVPMaker WordPress plugin prior to version 8.7.3. The Import feature at /wp-admin/tools.php?page=rsvpmaker_export_screen takes a user-supplied URL and invokes curl without validating that the URL is remote, enabling SSRF. This could allow a high-privilege admin to scan...
CVE-2021-24371 RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF
The Import feature of the RSVPMaker WordPress plugin before 8.7.3 /wp-admin/tools.php?page=rsvpmakerexportscreen takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network...
WordPress Plugin RSVPMaker 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability exists i...
RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF
The Import feature of the plugin /wp-admin/tools.php?page=rsvpmakerexportscreen takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack. PoC Go to the...
RSVPMaker < 8.7.3 - Authenticated (admin+) SSRF
The Import feature of the plugin /wp-admin/tools.php?page=rsvpmakerexportscreen takes an URL input and calls curl on it, without first validating it to ensure it's a remote one. As a result, a high privilege user could use that feature to scan the internal network via a SSRF attack. Go to the...
WordPress RSVPMaker plugin <= 8.7.2 - Authenticated Server-Side Request Forgery (SSRF) vulnerability
Authenticated Server-Side Request Forgery SSRF vulnerability discovered by Shreya Pohekar in WordPress RSVPMaker plugin versions = 8.7.2. Solution Update the WordPress RSVPMaker plugin to the latest available version at least 8.7.3...
PT-2021-3989 · WordPress · Rsvpmaker
Name of the Vulnerable Software and Affected Versions: RSVPMaker WordPress plugin versions prior to 8.7.3 Description: The issue is related to the Import feature of the RSVPMaker WordPress plugin, specifically with the "/wp-admin/tools.php?page=rsvpmaker export screen" endpoint. It is caused by...
RSVPMaker < 7.8.2 - Unauthenticated SQL Injection
The plugin does not sanitise user input before using it in a SQL statement in the signedupajax AJAX action. Note: Even though the reported SQL Injection was fixed in v7.8.2, other additional sanitisation was implemented in v7.8.3 to 7.8.6. PoC sqlmap -u "https://localhost/?action=signedupcount=1"...
RSVPMaker < 7.8.2 - Unauthenticated SQL Injection
The plugin does not sanitise user input before using it in a SQL statement in the signedupajax AJAX action. Note: Even though the reported SQL Injection was fixed in v7.8.2, other additional sanitisation was implemented in v7.8.3 to 7.8.6. sqlmap -u "https://localhost/?action=signedup&eventcount=...
WordPress RSVPMaker plugin <= 7.8.1 - Unauthenticated SQL Injection (SQLi) vulnerability
Unauthenticated SQL Injection SQLi vulnerability found by CBiu in WordPress RSVPMaker plugin versions = 7.8.1. Solution Update the WordPress RSVPMaker plugin to the latest available version at least 7.8.2...
WordPress rsvpmaker plugin SQL injection vulnerability
WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. rsvpmaker is used in one of the event scheduling and RSVP tracking plugin. A SQL injection vulnerability exists in WordPress...
CVE-2018-21004
The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection...
CVE-2018-21004
The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection...
CVE-2019-15646
The rsvpmaker plugin before 6.2 for WordPress has SQL injection...
CVE-2019-15646
The rsvpmaker plugin before 6.2 for WordPress has SQL injection...
Sql injection
The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection...
Sql injection
The rsvpmaker plugin before 6.2 for WordPress has SQL injection...
CVE-2018-21004
The rsvpmaker plugin before 5.6.4 for WordPress has SQL injection...
CVE-2018-21004
The CVE-2018-21004 entry concerns the WordPress RSVPMaker plugin, pre-5.6.4, containing a SQL injection vulnerability in its code path. Affected component: RSVPMaker plugin for WordPress. Root cause: improper handling of user-supplied input in SQL construction, enabling arbitrary SQL execution. I...