CVE-2026-88930

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...

EUVD-2026-96779

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-88930

The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to SQL injection attacks. The root cause is twofold: the plugin fails to require a shared secret before accepting authorized requests, and it fails to properly sanitise and escape a parameter used in an SQL statement. ...

CVE-2026-88930 Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret

The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...

CVE-2026-88931

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

CVE-2026-88931 Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

CVE-2026-88931

The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to an unauthenticated arbitrary plugin settings update . The root cause is a failure to restrict which settings can be modified via an unauthenticated endpoint. This allows an attacker to overwrite arbitrary plugin opt...

EUVD-2026-95504

The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...

WordPress Social Web Suite plugin <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update vulnerability

Unauthenticated Arbitrary Plugin Settings Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Social Web Suite versions = 4.1.12...

EUVD-2018-4551

Malware in sbrugna...

EUVD-2024-49118

Malicious code in bioql PyPI...

CVE-2024-8352

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the downloadlog function. This makes it possible for unauthenticated attackers to read the contents of arbitrary file...

CVE-2024-8352 Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the downloadlog function. This makes it possible for unauthenticated attackers to read the contents of arbitrary file...

CVE-2024-8352 Social Web Suite – Social Media Auto Post, Social Media Auto Publish <= 4.1.11 - Directory Traversal to Arbitrary File Download

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the downloadlog function. This makes it possible for unauthenticated attackers to read the contents of arbitrary file...

WordPress Social Web Suite plugin <= 4.1.11 - Directory Traversal to Arbitrary File Download vulnerability

Directory Traversal to Arbitrary File Download vulnerability discovered by Thanh Nam Tran in WordPress Plugin Social Web Suite versions = 4.1.11...

WordPress Social Web Suite Plugin <= 4.1.11 is vulnerable to Arbitrary File Download

Software Social Web Suite Type Plugin Vulnerable versions = 4.1.11 Fixed in 4.1.12 OWASP Top 10 A1: Broken Access Control Classification Arbitrary File Download CVE CVE-2024-8352 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 9b823a04681b Credits Thanh Nam Tran Required...

WordPress plugin Social Web Suite 路径遍历漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A path traversal...

CVE-2024-8352: Improper Limitation of a Pathname to a Restricted Directory

The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress is vulnerable to Directory Traversal in all versions up to, and including, 4.1.11 via the downloadlog function. This makes it possible for unauthenticated attackers to read the contents of arbitrary file...

PT-2024-38966 · WordPress · Social Web Suite – Social Media Auto Post

Name of the Vulnerable Software and Affected Versions: The Social Web Suite – Social Media Auto Post, Social Media Auto Publish plugin for WordPress versions up to, and including, 4.1.11 Description: The issue concerns a Directory Traversal vulnerability, which allows unauthenticated attackers to...

BillQuick Web Suite txtID SQL Injection

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'BillQuick Web Suite txtID SQLi', 'Description' = %q This module exploits a SQL injection vulnerability in BillQUick Web Suite prior to version...