CVE-2022-0328

The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack...

CVE-2022-0328 Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRF

The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack...

WordPress 跨站请求伪造漏洞

WordPress is a set of blogging platforms developed by the WordPress Foundation using the PHP language. A cross-site request forgery vulnerability exists in versions of the WordPress Simple Membership plugin prior to 4.0.9. The vulnerability stems from the fact that the Simple Membership plugin do...

WordPress Simple Membership plugin <= 4.0.9 - Arbitrary Transaction Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Transaction Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Muhamad Hidayat in WordPress Simple Membership plugin versions = 4.0.9. Solution Update the WordPress Simple Membership plugin to the latest available version at least 4.1.0...

Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRF

The plugin does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack PoC https://example.com/wp-admin/admin.php?page=simplewpmembershippayments=deletetxn=1 will delete the transaction with ID...

Simple Membership < 4.1.0 - Arbitrary Transaction Deletion via CSRF

The plugin does not have CSRF check in place when deleting Transactions, which could allow attackers to make a logged in admin delete arbitrary transactions via a CSRF attack https://example.com/wp-admin/admin.php?page=simplewpmembershippayments&action=deletetxn&id=1 will delete the transaction...

Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRF

The plugin does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack https://example.com/wp-admin/admin.php?page=simplewpmembership&action=bulkdelete&members%5B0%5D=1&members%5B1%5D=2...

Simple Membership < 4.0.9 - Arbitrary Member Deletion via CSRF

The plugin does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack PoC https://example.com/wp-admin/admin.php?page=simplewpmembership=bulkdelete%5B0%5D=1%5B1%5D=2...

WordPress Simple Membership plugin <= 4.0.8 - Arbitrary Member Deletion via Cross-Site Request Forgery (CSRF) vulnerability

Arbitrary Member Deletion via Cross-Site Request Forgery CSRF vulnerability discovered by Krzysztof Zając in WordPress Simple Membership plugin versions = 4.0.8. Solution Update the WordPress Simple Membership plugin to the latest available version at least 4.0.9...

CVE-2021-41472

SQL injection vulnerability in Sourcecodester Simple Membership System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username and password parameters...

CVE-2021-41472

SQL injection vulnerability in Sourcecodester Simple Membership System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username and password parameters...

CVE-2021-41472

CVE-2021-41472 concerns the Sourcecodester Simple Membership System v1 by oretnom23. The vulnerability is a SQL injection in the login flow, exploitable via the username and password parameters to execute arbitrary SQL commands. Affected component is the login/authentication handling; underlying ...

CVE-2021-41472

SQL injection vulnerability in Sourcecodester Simple Membership System v1 by oretnom23, allows attackers to execute arbitrary SQL commands via the username and password parameters...

WordPress Simple Membership plugin <= 4.0.3 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability discovered by Martin Vierula in WordPress Simple Membership plugin versions = 4.0.3. Solution Update the WordPress Simple Membership plugin to the latest available version at least 4.0.4...

Cross-site scripting vulnerability in Joomla! simpleMembership component

Joomla! is an open source content management system CMS, the system provides RSS feeds, site search and other functions. A cross-site scripting vulnerability exists in the Joomla! simpleMembership component. An attacker can insert malicious js code into the page to obtain user cookies and other...

File upload vulnerability in Joomla! simpleMembership component

Joomla! is an open source content management system CMS, the system provides RSS feeds, site search and other functions. A file upload vulnerability exists in the Joomla! simpleMembership component. An attacker can exploit the vulnerability to upload malicious files and gain server privileges...

Wordpress Simple Membership Plugin Cross-Site Request Forgery (CVE-2019-14328)

A cross-site request forgery vulnerability exists in Wordpress Simple Membership Plugin. A remote, unauthenticated attacker can exploit this vulnerability by enticing a user with administrator privileges to visit a page which sends a request to Simple Membership Plugin...

WordPress simple-membership plugin cross-site request forgery vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. simple-membership plugin is a website membership plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...

CVE-2016-10884

The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues...

CVE-2016-10884

CVE-2016-10884 affects the WordPress Simple Membership plugin prior to 3.3.3, with multiple CSRF vulnerabilities. The Red Hat, CVE databases and WP vulnerability feeds consistently describe CSRF flaws in this plugin version. The root cause is improper CSRF protection allowing unauthorized state-c...