WordPress JupiterX Theme <= 3.0.0 is vulnerable to Local File Inclusion

Software JupiterX Type Theme Vulnerable versions = 3.0.0 Fixed in 3.1.0 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-32110 Patch priority High CVSS severity High 7.6 Developer Claim ownership PSID 5d8f9e2208af Credits Rafie Muhammad Patchstack Required privilege...

WordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL Injection

Software CM Pop-Up banners Type Plugin Vulnerable versions = 1.5.10 Fixed in 1.6.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-30750 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID a1957d5dbbe6 Credits Dave Jong Patchstack Required privilege...

CVE-2023-1125 Ruby Help Desk < 1.3.4 - Subscriber+ Ticket Update via IDOR

The Ruby Help Desk WordPress plugin before 1.3.4 does not ensure that the ticket being modified belongs to the user making the request, allowing an attacker to close and/or add files and replies to tickets other than their own...

CVE-2023-1861 Limit Login Attempts < 1.7.2 - Subscriber+ Stored XSS

The Limit Login Attempts WordPress plugin through 1.7.2 does not sanitize and escape usernames when outputting them back in the logs dashboard, which could allow any authenticated users, such as subscriber to perform Stored Cross-Site Scripting attacks...

WordPress AJAX Thumbnail Rebuild Plugin <= 1.13 is vulnerable to Broken Access Control

Software AJAX Thumbnail Rebuild Type Plugin Vulnerable versions = 1.13 Fixed in 1.14 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2022-47604 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID b90f03667897 Credits Justiice Required...

WordPress WooCommerce Order Status Change Notifier Plugin <= 1.1.0 is vulnerable to Broken Access Control

Software WooCommerce Order Status Change Notifier Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-2179 Patch priority Medium CVSS severity Medium 4.3 Developer Claim ownership PSID 6ed55575f434 Credits...

WooCommerce Multivendor Marketplace – REST API < 1.6.0 - Subscriber+ Arbitrary Orders Item And Notes Update

The plugin does not properly implement capability checks on the 'getitem', 'getordernotes', and 'addordernote' functions, leading to potential unauthorized access and addition of those items by authenticated users with subscriber privileges or above...

Booking Manager < 2.0.29 - Subscriber+ SSRF

The plugin does not validate URLs input in it's admin panel or in shortcodes for showing events from a remote .ics file, allowing an attacker with privileges as low as Subscriber to perform SSRF attacks on the sites internal network. As an admin: Type in an internal URL for example...

CVE-2023-27619

Auth subscriber+ Reflected Cross-Site Scripting XSS vulnerability in Macho Themes Regina Lite theme = 2.0.7 versions...

CVE-2023-27619

Auth subscriber+ Reflected Cross-Site Scripting XSS vulnerability in Macho Themes Regina Lite theme = 2.0.7 versions...

YARPP - Yet Another Related Posts Plugin < 5.30.3 - Subscriber+ SQLi

The plugin does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks. Run the below command in the developer console of the web browser while being on the blog...

YARPP - Yet Another Related Posts Plugin < 5.30.3 - Subscriber+ SQLi

The plugin does not validate and escape some of its shortcode attributes before using them in SQL statement/s, which could allow any authenticated users, such as subscribers to perform SQL Injection attacks. PoC Run the below command in the developer console of the web browser while being on the...

CVE-2023-0388 Random Text <= 0.3.0 - Subscriber+ SQLi

The Random Text WordPress plugin through 0.3.0 does not properly sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by any authenticated users, such as subscribers...

Nokia OneNDS 权限许可和访问控制问题漏洞

Nokia OneNDS is a web directory server from Nokia, Finland. It is a core element of the Subscriber Data Management SDM solution. A vulnerability in Nokia OneNDS 17r2 exists in the form of a privilege permission and access control issue vulnerability that stems from incorrect privilege management...

Nokia OneNDS 权限许可和访问控制问题漏洞

Nokia OneNDS is a web directory server from Nokia, Finland. It is a core element of the Subscriber Data Management SDM solution. A privilege permission and access control issue vulnerability exists in Nokia OneNDS version 20.9, which stems from an error in the security configuration and can be...

WordPress Accessibility Suite by Online ADA Plugin <= 4.12 is vulnerable to SQL Injection

Software Accessibility Suite by Online ADA Type Plugin Vulnerable versions = 4.12 Fixed in 4.13 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47420 Patch priority Medium CVSS severity Medium 6.4 Developer Claim ownership PSID cf5c7e0f9b45 Credits minhtuanact Required...

Input validation

An Improper Check for Unusual or Exceptional Conditions vulnerability in the bbe-smgd of Juniper Networks Junos OS allows an unauthenticated, adjacent attacker to cause a Denial of Service DoS. In a Broadband Edge / Subscriber Management scenario on MX Series when a specifically malformed ICMP...

CVE-2023-1274

The Pricing Tables For WPBakery Page Builder formerly Visual Composer WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks...

CVE-2023-1274

The Pricing Tables For WPBakery Page Builder formerly Visual Composer WordPress plugin before 3.0 does not validate some shortcode attributes before using them to generate paths passed to include function/s, allowing any authenticated users such as subscriber to perform LFI attacks...

Cross site request forgery (csrf)

Themeflection Numbers WordPress plugin before 2.0.1 does not have authorisation and CSRF check in an AJAX action, and does not ensure that the options to be updated belong to the plugin. As a result, it could allow any authenticated users, such as subscriber, to update arbitrary blog options, suc...