WordPress Plugin MStore API 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

MStore API < 3.9.7 - Multiple CSRF

The plugin does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks, such as Order Status Update, Order Title Update, Product Limit Update, Order Message Update, and Firebase Server Key Update...

CVE-2023-2179 WooCommerce Order Status Change Notifier <= 1.1.0 - Subscriber+ Arbitrary Order Status Update

The WooCommerce Order Status Change Notifier WordPress plugin through 1.1.0 does not have authorisation and CSRF when updating status orders via an AJAX action available to any authenticated users, which could allow low privilege users such as subscriber to update arbitrary order status, making...

CVE-2022-48364

The undomarkstatusesassensitive method in app/services/approveappealservice.rb in Mastodon 3.5.x before 3.5.3 does not use the server's representative account, resulting in moderator identity disclosure when a moderator approves the appeal of a user whose status update was marked as sensitive...

Sql injection

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This issue affects some unknown processing of the file admin/registrations/updatestatus.php of the component Status Update Handler. The manipulation of the argument id leads to sql injection...

CVE-2023-0980 SourceCodester Yoga Class Registration System Status Update update_status.php sql injection

A vulnerability was found in SourceCodester Yoga Class Registration System 1.0 and classified as critical. This issue affects some unknown processing of the file admin/registrations/updatestatus.php of the component Status Update Handler. The manipulation of the argument id leads to sql injection...

PT-2023-16662 · Sourcecodester · Sourcecodester Yoga Class Registration System

Name of the Vulnerable Software and Affected Versions: SourceCodester Yoga Class Registration System version 1.0 Description: A critical issue affects the Status Update Handler component, specifically the file admin/registrations/update status.php. The manipulation of the id argument leads to SQL...

CVE-2022-0421 Five Star Restaurant Reservations < 2.4.12 - Unauthenticated Arbitrary Payment Status Update to Stored XSS

The Five Star Restaurant Reservations WordPress plugin before 2.4.12 does not have authorisation when changing whether a payment was successful or failed, allowing unauthenticated users to change the payment status of arbitrary bookings. Furthermore, due to the lack of sanitisation and escaping,...

编号撤回

This CVE number has been withdrawn...

Multivendor Marketplace Solution for WooCommerce < 3.8.12 - Unauthorised AJAX Calls

The plugin is lacking authorisation and CSRF in multiple AJAX actions, which could allow any authenticated users, such as subscriber to call them and suspend vendors reporter by the submitter or update arbitrary order status identified by WPScan when verifying the issue for example. Other...

CVE-2021-45461

creationtimestamp| type| source ---|---|--- 2022-07-18 20:36:45+00:00| exploited| https://t.me/truesecator/3189 2026-01-29 14:36:26+00:00| seen| https://threatintel.cc/2026/01/29/unveiling-the-weaponized-web-shell.html 2026-01-29 14:42:05+00:00| seen| MISP/30dbf7d0-e101-412c-b155-26c5c47a7558...

CVE-2022-0825 Amelia < 1.0.49 - Customer+ Arbitrary Appointments Status Update

The Amelia WordPress plugin before 1.0.49 does not have proper authorisation when managing appointments, allowing any customer to update other's booking status, as well as retrieve sensitive information about the bookings, such as the full name and phone number of the person who booked it...

WordPress Amelia plugin <= 1.0.48 - Arbitrary Appointments Status Update vulnerability

Arbitrary Appointments Status Update vulnerability discovered by Huli from Cymetrics in WordPress Amelia plugin versions = 1.0.48. Solution Update the WordPress Amelia plugin to the latest available version at least 1.0.49...

CVE-2022-0530

creationtimestamp| type| source ---|---|--- 2022-02-10 02:13:32+00:00| seen| https://t.me/cibsecurity/37151 2022-02-28 05:13:02+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1553 2022-02-28 05:46:53+00:00| published-proof-of-concept| https://t.me/GithubRedTeam/1554 2025-07-08...

Denial Of Service (DoS)

linux is vulnerable to denial of service. The vulnerability exists due to a race conditions during an update of the local and shared status which allows an attacker to crash the application via malicious input...

Race condition

An issue was discovered in the Linux kernel before 5.11.7. usbipsockfdstore in drivers/usb/usbip/stubdev.c allows attackers to cause a denial of service GPF because the stub-up sequence has race conditions during an update of the local and shared status, aka CID-9380afd6df70...

CVE-2019-10552

creationtimestamp| type| source ---|---|--- 2020-03-05 14:07:08+00:00| seen| https://t.me/cibsecurity/10307 2026-01-20 08:04:55+00:00| seen| https://infosec.exchange/users/certvde/statuses/115926387351405846...

CVE-2019-10577

creationtimestamp| type| source ---|---|--- 2020-03-05 13:13:07+00:00| seen| https://t.me/cibsecurity/10303 2026-01-20 08:04:54+00:00| seen| https://infosec.exchange/users/certvde/statuses/115926387351405846...

Description of the security update for SharePoint Server 2019: November 12, 2019

None None...

Jamroom Cross-Site Scripting Vulnerability

Jamroom is a social media content management system. The system helps build social networks, content communities, blogs and more. A cross-site scripting vulnerability exists in versions of Jamroom prior to 4.2.7. A remote attacker can exploit this vulnerability to inject arbitrary web script or...