PT-2022-9642 · WordPress · Advanced Page Visit Counter

Name of the Vulnerable Software and Affected Versions: Advanced Page Visit Counter WordPress plugin versions prior to 6.1.2 Description: The issue allows unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing the admin dashboard page, due to the plugin not...

WordPress Advanced Page Visit Counter plugin SQL Injection Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

CVE-2021-24957

The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvcresetcountart AJAX action, available to any authenticated user, leading to a SQL injection...

Sql injection

The Advanced Page Visit Counter WordPress plugin before 6.1.6 does not escape the artID parameter before using it in a SQL statement in the apvcresetcountart AJAX action, available to any authenticated user, leading to a SQL injection...

WordPress plugin Advanced Page Visit Counter SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it As unauthenticated: wget "https://example.com/?p=1" --header "Referer: " -O- The XSS will be...

Advanced Page Visit Counter < 6.1.2 - Unauthenticated Stored Cross-Site Scripting

The plugin does not sanitise and escape some input before outputting it in an admin dashboard page, allowing unauthenticated attackers to perform Cross-Site Scripting attacks against admins viewing it PoC As unauthenticated: wget "https://example.com/?p=1" --header "Referer: " -O- The XSS will be...

WordPress Advanced Page Visit Counter <= 6.1.1 - Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability

Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Krzysztof Zając in WordPress Advanced Page Visit Counter versions = 6.1.1. Solution Update the WordPress Advanced Page Visit Counter – Most Advanced WordPress Visit Counter Plugin to the latest available version at least...

Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection

The plugin does not escape the artID parameter before using it in a SQL statement in the apvcresetcountart AJAX action, available to any authenticated user, leading to a SQL injection v = 5.0.8 - https://example.com/wp-admin/admin-ajax.php?action=apvcresetcountart&artID=sleep10 v 6.1.6 -...

WordPress Advanced Page Visit Counter <= 6.1.5 - Blind SQL Injection (SQLi) vulnerability

Blind SQL Injection SQLi vulnerability discovered by Krzysztof Zając in WordPress Advanced Page Visit Counter versions = 6.1.5. Solution Update the WordPress Advanced Page Visit Counter – Most Advanced WordPress Visit Counter Plugin to the latest available version at least 6.1.6...

Advanced Page Visit Counter < 6.1.6 - Subscriber+ Blind SQL injection

The plugin does not escape the artID parameter before using it in a SQL statement in the apvcresetcountart AJAX action, available to any authenticated user, leading to a SQL injection PoC v = 5.0.8 - https://example.com/wp-admin/admin-ajax.php?action=apvcresetcountart=sleep10 v 6.1.6 -...

WordPress Page Visit Counter plugin <= 6.0.8 - Sensitive Information Disclosure vulnerability

Sensitive Information Disclosure vulnerability discovered in WordPress Page Visit Counter plugin versions = 6.0.8. Solution No patched version available...

WordPress Advanced Page Visit Counter – Most Advanced WordPress Visit Counter Plugin <= 5.0.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Advanced Page Visit Counter – Most Advanced WordPress Visit Counter Plugin versions = 5.0.8. Solution Update the WordPress Advanced Page Visit Counter – Most Advanced WordPress Visit Counter Plugin to...

WordPress Page Visit Counter plugin <= 6.0.8 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability

Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Page Visit Counter plugin versions = 6.0.8. Solution No patched version available...

WordPress Page Visit Counter plugin <= 4.4 - Reflected Cross-Site Scripting (XSS) vulnerability

Reflected Cross-Site Scripting XSS vulnerability found by ThreatPress Security Research Team in WordPress Page Visit Counter plugin versions = 4.4. Solution Update the WordPress Page Visit Counter plugin to the latest available version at least 4.5...

WordPress Page Visit Counter plugin <= 4.0.9 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability found by ThreatPress Research Team in WordPress Page Visit Counter plugin versions = 4.0.9. Solution Update the WordPress Page Visit Counter plugin to the latest available version at least 4.1...

PHP Visit Counter <= 0.4 (datespan) SQL Injection Vulnerability

No description provided by source. PHP Visit Counter = 0.4 - SQL Injection Vulnerability Vulnerability discovered by: LidlosesAuge Greetz to: -=Player=- , Suicide, g4ms3, enco, GPM, Free-Hack, Ciphercrew, h4ck-y0u Date: 30.05.2008 Dork: inurl:read.php?datespan= Vulnerability: 1. SQL Injection 1.1...

CVE-2008-4146

Addalink 1.0 beta 4 and earlier allows remote attackers to 1 approve web-site additions via a modified approved field and 2 change the visit-counter value via a modified counter field...

Code injection

Addalink 1.0 beta 4 and earlier allows remote attackers to 1 approve web-site additions via a modified approved field and 2 change the visit-counter value via a modified counter field...

CVE-2008-4146

Affected software: Addalink 1.0 beta 4 and earlier. Vulnerable component/function: website configuration fields processed by Addalink that allow remote modification. Root cause/impact: an attacker can remotely alter the approved field to approve site additions and modify the counter field to chan...