58 matches found
WoWonder Social Network Platform SQL注入漏洞
WoWonder Social Network Platform is a PHP social networking script by WoWonder. It is used to create your own social networking website. A security vulnerability exists in WoWonder Social Network Platform version v4.1.2, which stems from an attacker being able to implement SQL injection via the...
WoWonder Social Network Platform SQL注入漏洞
WoWonder Social Network Platform is a PHP social networking script by WoWonder. It is used to create your own social networking website. A security vulnerability exists in WoWonder Social Network Platform version 4.1.4, which stems from an attacker being able to implement SQL injection via the...
CVE-2022-42984
Affected software: WoWonder Social Network Platform 4.1.4. Vulnerability: SQL injection via the offset parameter in requests.php?f=search&s=recipients. Root cause: insufficient input handling for the offset parameter leading to injected SQL. Impact: high across confidentiality, integrity, and ava...
CVE-2022-40405
CVE-2022-40405 affects WoWonder Social Network Platform v4.1.2 and is due to a SQL injection vulnerability in the offset parameter of requests.php?f=load-my-blogs. The CVSS 3.1 base score is 7.5 (High), with network attack vector, no privileges required, no user interaction, and a confidentiality...
CVE-2022-40405
WoWonder Social Network Platform v4.1.2 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=load-my-blogs...
CVE-2022-42984
WoWonder Social Network Platform 4.1.4 was discovered to contain a SQL injection vulnerability via the offset parameter at requests.php?f=search&s=recipients...
CVE-2022-1753
A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument groupid allows posting messages in other groups. It is possible to launch the attack remotely but it might...
Authentication flaw
A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument groupid allows posting messages in other groups. It is possible to launch the attack remotely but it might...
CVE-2022-1753
Summary: CVE-2022-1753 affects WoWonder via /requests.php, where manipulating the group_id parameter enables posting messages in other groups. The vulnerability can be triggered remotely, with some sources noting authentication may be required. This indicates a broken access control condition in ...
CVE-2022-1753 WoWonder Group requests.php access control
A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument groupid allows posting messages in other groups. It is possible to launch the attack remotely but it might...
CVE-2022-1753 WoWonder Group requests.php access control
A vulnerability, which was classified as critical, was found in WoWonder. Affected is the file /requests.php which is responsible to handle group messages. The manipulation of the argument groupid allows posting messages in other groups. It is possible to launch the attack remotely but it might...
Envato WoWonder 安全漏洞
Envato WoWonder is an application from the Australian company Envato. It provides a PHP social networking script. A security vulnerability exists in Envato WoWonder. An attacker could use this vulnerability to post messages in other groups via the groupid operation...
CVE-2022-26254
WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names...
CVE-2022-26254
WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names...
Command injection
WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names...
CVE-2022-26254
WoWonder The Ultimate PHP Social Network Platform v4.0.0 was discovered to contain an access control issue which allows unauthenticated attackers to arbitrarily change group ID names...
CVE-2022-26254
CVE-2022-26254 affects WoWonder The Ultimate PHP Social Network Platform v4.0.0. The connected Red Hat and CVE sources corroborate a post-authentication bypass of access controls that lets unauthenticated attackers arbitrarily change group ID names. The description consistently states an access c...
Envato WoWonder 安全漏洞
Envato WoWonder is an application from the Australian company Envato. It provides a PHP social networking script. A security vulnerability exists in WoWonder The Ultimate PHP Social Network Platform v4.0.0 that could allow an unauthenticated attacker to arbitrarily change group ID names...
