SEO Need-to-Knows: Google’s Core Web Vitals, Part 2 of 5

Learn about Google's Core Web Vitals — LCP, FID, and CLS — and how improving them can enhance your users’ experience and SEO ranking...

WordPress MainWP WordPress SEO Extension Plugin <= 4.0.1 is vulnerable to Broken Access Control

Software MainWP WordPress SEO Extension Type Plugin Vulnerable versions = 4.0.1 Fixed in 4.0.3 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-23746 Patch priority Medium CVSS severity Medium 5.4 Developer Claim ownership PSID eb8b01abda06 Credits Dave Jon...

Raccoon and Vidar Stealers Spreading via Massive Network of Fake Cracked Software

A "large and resilient infrastructure" comprising over 250 domains is being used to distribute information-stealing malware such as Raccoon and Vidar since early 2020. The infection chain "uses about a hundred of fake cracked software catalogue websites that redirect to several links before...

Australian Healthcare Sector Targeted in Latest Gootkit Malware Attacks

A recent wave of Gootkit malware loader attacks has targeted the Australian healthcare sector by leveraging legitimate tools like VLC Media Player. Gootkit, also called Gootloader, is known to employ search engine optimization SEO poisoning tactics aka spamdexing for initial access. It typically...

Australian Healthcare Sector Targeted in Latest Gootkit Malware Attacks

A recent wave of Gootkit malware loader attacks has targeted the Australian healthcare sector by leveraging legitimate tools like VLC Media Player. Gootkit, also called Gootloader, is known to employ search engine optimization SEO poisoning tactics aka spamdexing for initial access. It typically...

Gootkit Loader Actively Targets Australian Healthcare Industry

We analyzed the infection routine used in recent Gootkit loader attacks on the Australian healthcare industry and found that Gootkit leveraged SEO poisoning for its initial access and abused legitimate tools like VLC Media Player...

CVE-2022-4352

The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-4351

The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

Sql injection

The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-4352 Qe SEO Handyman <= 1.0 - Admin+ SQLi

The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-4352

CVE-2022-4352 concerns the Qe SEO Handyman WordPress plugin (versions

CVE-2022-4352 Qe SEO Handyman <= 1.0 - Admin+ SQLi

The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-4351 Qe SEO Handyman <= 1.0 - Admin+ SQLi

The Qe SEO Handyman WordPress plugin through 1.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by high privilege users such as admin...

CVE-2022-4351

The CVE-2022-4351 entry concerns the Qe SEO Handyman WordPress plugin (versions 1.0 and earlier). The issue is a SQL injection caused by insufficient sanitization/escaping of a parameter before it is used in a SQL statement, enabling exploitation by high-privilege users (e.g., admin). Documents d...

PT-2023-14230 · WordPress · Qe Seo Handyman Wordpress Plugin

Name of the Vulnerable Software and Affected Versions: Qe SEO Handyman WordPress plugin versions 1.0 and earlier Description: The issue arises from the plugin's failure to properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be exploite...

WordPress plugin Qe SEO Handyman SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A SQL injection vulnerability exists in...

Optimize images ALT Text (alt tag) & names for SEO using AI < 2.0.8 - Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. Use the following form to abuse the CSRF vulnerability on the settings page: action layout textColor contentBackgroundColor starColor...

WordPress Optimize images ALT Text (alt tag) & names for SEO using AI Plugin < 2.0.8 is vulnerable to Cross Site Request Forgery (CSRF)

Software Optimize images ALT Text alt tag & names for SEO using AI Type Plugin Vulnerable versions 2.0.8 Fixed in 2.0.8 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-4548 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

Optimize images ALT Text (alt tag) & names for SEO using AI < 2.0.8 - Settings Update via CSRF

The plugin does not have CSRF check in place when updating its settings, which could allow attackers to make a logged-in admin change them via a CSRF attack. PoC Use the following form to abuse the CSRF vulnerability on the settings page: action| ---|--- layout| textColor| contentBackgroundColor|...

Yoast SEO Plugin for WordPress < 1.5.7 Multiple Vulnerabilities

The WordPress Yoast SEO Plugin installed on the remote host is affected by multiple Cross-Site Request Forgery and multiple SQL Injection. Note that the scanner has not tested for these issues but has instead relied only on the application's self-reported version number. No source data...