CVE-2023-5054

The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to and including 6.9.3 . The root cause is insufficient restrictions on the sendMail.php file, which allows direct access by attackers. This enables unauthenticated actor...

WordPress plugin Super Store Finder security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Super Store Finder 3.7 Remote Command Execution Vulnerability

Vulnerability : Authenticated Arbitrary PHP Code Injection lead to Remote Code Execution Researcher : Etharus Vendor : Joe Iz, https://www.superstorefinder.net/ Demo Url : https://superstorefinder.net/products/superstorefinder/ Version Affected : 3.7 and below Date : 18 September 2023 FOFA Dork :...

WordPress Super Store Finder Plugin <= 6.9.3 is vulnerable to Broken Access Control

Software Super Store Finder Type Plugin Vulnerable versions = 6.9.3 Fixed in 6.9.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-5054 Patch priority Medium CVSS severity Medium 5.8 Developer Claim ownership PSID 31fa9f5f6872 Credits Etharus Required...

CVE-2023-5054: Missing Authorization

The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attacker...

Super Store Finder 3.7 Remote Command Execution

Vulnerability : Authenticated Arbitrary PHP Code Injection lead to Remote Code Execution Researcher : Etharus Vendor : Joe Iz, https://www.superstorefinder.net/ Demo Url : https://superstorefinder.net/products/superstorefinder/ Version Affected : 3.7 and below Date : 18 September 2023 FOFA Dork :...

VulnCheck KEV: CVE-2023-5054

The Super Store Finder plugin for WordPress is vulnerable to unauthenticated arbitrary email creation and relay in versions up to, and including, 6.9.3. This is due to insufficient restrictions on the sendMail.php file that allows direct access. This makes it possible for unauthenticated attacker...

PT-2023-31583 · WordPress · Super Store Finder

Name of the Vulnerable Software and Affected Versions: Super Store Finder plugin for WordPress versions up to, and including, 6.9.3 Description: The issue is related to insufficient restrictions on the sendMail.php file, allowing direct access and enabling unauthenticated attackers to send emails...

CVE-2023-38912

SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter...

CVE-2023-38912

SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter...

CVE-2023-38912

SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter...

Sql injection

SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter...

CVE-2023-38912

CVE-2023-38912 affects the Super Store Finder PHP Script v3.6. The vulnerability is an SQL injection in the username parameter of the application, causing a remote attacker to execute arbitrary code. The CVSS 3.1 base score is 9.8 (CRITICAL) with network access, no user interaction, and high impa...

CVE-2023-38912

SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter...

PT-2023-26683

Name of the Vulnerable Software and Affected Versions Super Store Finder PHP Script version 3.6 Description A SQL injection issue allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter. This enables the attacker to potentially access and manipulate...

CVE-2023-38912: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Super Store Finder PHP Script v.3.6 allows a remote attacker to execute arbitrary code via a crafted payload to the username parameter...

Super Store Finder SQL Injection Vulnerability

Super Store Finder is an easy-to-use Google Maps API store finder program Super Store Finder by Super Store Finder. A security vulnerability exists in Super Store Finder version v.3.6, which stems from a vulnerability that allows a remote attacker to execute arbitrary code via a carefully crafted...

PT-2023-9742 · Linux +1 · Linux Kernel +1

Name of the Vulnerable Software and Affected Versions: Linux kernel versions prior to the version that includes the fix for the f2fs reference count leak Description: The issue is related to a reference count leak in the f2fs component of the Linux kernel. During the f2fs put super function, a...

File Manager Pro < 1.8 - Remote Code Execution via CSRF

Description The plugin does not properly check the CSRF nonce in the fsconnector AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell. PoC As a Super Admin, run the following...

File Manager Pro < 1.8 - Remote Code Execution via CSRF

Description The plugin does not properly check the CSRF nonce in the fsconnector AJAX action. This allows attackers to make highly privileged users perform unwanted file system actions via CSRF attacks by using GET requests, such as uploading a web shell. As a Super Admin, run the following code ...