68 matches found
CVE-2026-54806
WP Activity Log PHP オブジェクトインジェクション CVE-2026-54806 PoC 📜 説明 CVE-2026-54806 は、Melapress 製の WP Activity Log WordPress プラグイン wp-security-audit-log における、認証不要の PHP オブジェクトインジェクションの深刻な脆弱性 CVSS 9.8 です。認証されていない攻撃者は、ログが記録されるイベント（例: ログイン失敗）を引き起こす任意のリクエストの User-Agent ヘッダーを介して、シリアライズされた PHP...
CVE-2024-10793
CVE-2024-10793 CVE-2024-10793 PoCエクスプロイト CVE-2024-10793.yaml スクリプトはプラグインを検索するために必要です。 CVE-2024-10793.sh スクリプトがエクスプロイト本体です。 ポストエクスプロイテーションには、beef-xss を使用できます。 Google dork: inurl:wp-content/plugins/wp-security-audit-log WordPress 用 WP Activity Log プラグインは、5.2.1 までの全バージョンにおいて、userid...
CVE-2025-0924-different
CVE-2025-0924 分析中に見つかったその他の脆弱性 01. Stored XSS と WordPress、WP Activity Log の概要 1 Stored XSS と WordPress、WP Activity Log の概要 Stored XSS は、悪意のあるスクリプトがサーバーに保存され、その後他のユーザーがそのページを開いたときに自動的に実行される脆弱性であり、CWE-79 Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting'...
CVE-2026-65512
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...
EUVD-2026-48118
Unauthenticated Cross Site Request Forgery CSRF in WP Activity Log = 5.6.4 versions...
CVE-2026-65512 WordPress WP Activity Log and WP Activity Log Premium plugins <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...
WordPress WP Activity Log plugin <= 5.6.4 - Cross Site Request Forgery (CSRF) vulnerability
Cross Site Request Forgery CSRF vulnerability discovered by Levon Balyan in WordPress Plugin WP Activity Log versions = 5.6.4...
CVE-2026-65512: Cross-Site Request Forgery (CSRF)
Cross-Site request forgery CSRF vulnerability in Melapress WP Activity Log and Melapress WP Activity Log Premium allows Cross Site Request Forgery. This issue affects WP Activity Log: through 5.6.4; WP Activity Log Premium: through 5.6.4...
CVE-2026-56005: Improper Neutralization of Input During Web Page Generation
Subscriber Cross Site Scripting XSS in WP Activity Log = 5.6.3.1 versions...
WordPress WP Activity Log plugin <= 5.6.3.1 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin WP Activity Log versions = 5.6.3.1...
CVE-2026-54806: Deserialization of Untrusted Data
Unauthenticated PHP Object Injection in WP Activity Log = 5.6.3.1 versions...
CVE-2026-45435
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3...
CVE-2026-45435 WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3...
CVE-2026-45435 WordPress WP Activity Log plugin <= 5.6.3 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3...
CVE-2026-45435: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP Activity Log allows DOM-Based XSS. This issue affects WP Activity Log: from n/a through 5.6.3...
CVE-2026-25331
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n/a through = 5.5.4...
CVE-2026-25331: Improper Neutralization of Input During Web Page Generation
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP Activity Log wp-security-audit-log allows DOM-Based XSS.This issue affects WP Activity Log: from n/a through = 5.5.4...
CVE-2023-50905
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in Melapress WP Activity Log allows Stored XSS.This issue affects WP Activity Log: from n/a through 4.6.1...
CVE-2024-2018
The WP Activity Log Premium plugin for WordPress is vulnerable to SQL Injection via the entry-roles parameter in all versions up to, and including, 4.6.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...