Simple Download Monitor < 3.9.5 - Reflected Cross-Site Scripting

The plugin does not escape the 1 sdmactivetab GET parameter and 2 sdmstatsstartdate/sdmstatsenddate POST parameters before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues PoC 1: This requires Firefox due to onclick+accesskey trick on hidden input. There is...

Simple Download Monitor < 3.9.6 - Unauthenticated Log Access

The plugin saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to download and read the logs containing Sensitive Information such as IP Addresses and Usernames...

WordPress Simple Download Monitor plugin <= 3.9.5 - Unauthorized Log Reset vulnerability

Unauthorized Log Reset vulnerability discovered by WPScanTeam in WordPress Simple Download Monitor plugin versions = 3.9.5. Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.9.6...

WordPress Simple Download Monitor plugin <= 3.9.5 - Unauthorized Log Reset vulnerability

Unauthorized Log Reset vulnerability discovered by WPScanTeam in WordPress Simple Download Monitor plugin versions = 3.9.5. Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.9.6...

WordPress Simple Download Monitor SQL Injection Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Simple Download Monito is used in one of the site download management plugin. A SQL injection vulnerability exists in Simple Download...

WordPress Simple Download Monitor Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Simple Download Monito is used in one of the site download management plugin. A cross-site scripting vulnerability exists in Simple...

CVE-2020-5651

SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL...

CVE-2020-5650

Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2020-5650

Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors...

Sql injection

SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL...

Cross site scripting

Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2020-5651

CVE-2020-5651 affects the WordPress plugin Simple Download Monitor (versions 3.8.8 and earlier). The root cause is SQL injection via a specially crafted URL that bypasses input validation, allowing remote attackers to execute arbitrary SQL commands. Documented impact includes the ability to run a...

CVE-2020-5651

SQL injection vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to execute arbitrary SQL commands via a specially crafted URL...

CVE-2020-5650

Cross-site scripting vulnerability in Simple Download Monitor 3.8.8 and earlier allows remote attackers to inject an arbitrary script via unspecified vectors...

CVE-2020-5650

CVE-2020-5650 is a cross-site scripting (XSS) vulnerability in the WordPress plugin Simple Download Monitor (versions ≤ 3.8.8). The issue allows remote attackers to inject arbitrary scripts via unspecified vectors, potentially affecting the logged-in user’s browser. Multiple connected sources con...

Multiple vulnerabilities in WordPress Plugin "Simple Download Monitor"

Overview WordPress Plugin "Simple Download Monitor" provided by Tips and Tricks HQ contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2020-5650 SQL Injection CWE-89 - CVE-2020-5651 Gen Sato of Mitsui Bussan Secure Directions, Inc. reported this vulnerability to the...

WordPress Simple Download Monitor plugin <= 3.8.8 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability found by Gen Sato Mitsui Bussan Secure Directions in WordPress Simple Download Monitor plugin versions = 3.8.8. Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.8.9...

WordPress Simple Download Monitor plugin <= 3.8.8 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability found by Gen Sato Mitsui Bussan Secure Directions in WordPress Simple Download Monitor plugin versions = 3.8.8 . Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.8.9...

JVN#31425618: Multiple vulnerabilities in WordPress Plugin "Simple Download Monitor"

WordPress Plugin "Simple Download Monitor" provided by Tips and Tricks HQ contains multiple vulnerabilities listed below. Cross-site Scripting CWE-79 - CVE-2020-5650 Version| Vector| Score ---|---|--- CVSS v3| CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N| Base Score: 6.1 CVSS v2|...

WordPress Simple Download Monitor plugin <= 3.8.8 - Unauthenticated Cross-Site Scripting (XSS) vulnerability

Unauthenticated Cross-Site Scripting XSS vulnerability found by Gen Sato Mitsui Bussan Secure Directions in WordPress Simple Download Monitor plugin versions = 3.8.8 . Solution Update the WordPress Simple Download Monitor plugin to the latest available version at least 3.8.9...