CVE-2021-25076

CVE-2021-25076-Exploit Plugin de WordPress WP User Frontend 3.5.26 - Inyección SQL Autenticado Descripción del CVE: El plugin de WordPress WP User Frontend anterior a la versión 3.5.26 no valida ni escapa el parámetro status antes de usarlo en una sentencia SQL en el panel de Suscriptores, lo que...

WordPress WP User Frontend 3.5.25 SQL Injection

Exploit Title: WordPress Plugin WP User Frontend 3.5.25 - SQLi Authenticated Date 20.02.2022 Exploit Author: Ron Jost Hacker5preme Vendor Homepage: https://wedevs.com/ Software Link: https://downloads.wordpress.org/plugin/wp-user-frontend.3.5.25.zip Version: 3.5.25 Tested on: Ubuntu 20.04 CVE:...

CVE-2021-25076 WP User Frontend < 3.5.26 - SQL Injection to Reflected Cross-Site Scripting

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting...

CVE-2021-25076: Improper Neutralization of Special Elements used in an SQL Command

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting...

PT-2022-9632

Name of the Vulnerable Software and Affected Versions WP User Frontend WordPress plugin versions prior to 3.5.26 Description The issue arises from the lack of validation and escaping of the status parameter before it is used in a SQL statement in the Subscribers dashboard. This oversight can lead...

VulnCheck KEV: CVE-2021-25076

The WP User Frontend WordPress plugin before 3.5.26 does not validate and escape the status parameter before using it in a SQL statement in the Subscribers dashboard, leading to an SQL injection. Due to the lack of sanitisation and escaping, this could also lead to Reflected Cross-Site Scripting...

Newsletter by Supsystic <= 1.5.6 - Authenticated SQL Injection

The GET parameter "sidx" is used in a SQL statement without being sanitised when searching for subscribers in the dashboard, leading to an authenticated SQL Injection issue. PoC The PoC will be displayed once the issue has been remediated...