WordPress Table of Contents Plus Plugin <= 2302 is vulnerable to Cross Site Request Forgery (CSRF)

Software Table of Contents Plus Type Plugin Vulnerable versions = 2302 Fixed in 2309 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-44473 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 9767a2935241 Credits Muhammad Daffa...

WordPress Instant CSS Plugin <= 1.2.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software Instant CSS Type Plugin Vulnerable versions = 1.2.1 Fixed in 1.2.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-44243 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID a017a7cc7d6c Credits Nguyen Xuan Chien...

WordPress Astra Bulk Edit Plugin <= 1.2.7 is vulnerable to Broken Access Control

Software Astra Bulk Edit Type Plugin Vulnerable versions = 1.2.7 Fixed in 1.2.8 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-44148 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID eb8e23601d3b Credits Rafie Muhammad Patchstack...

WordPress Essential Blocks Pro Plugin <= 1.1.0 is vulnerable to PHP Object Injection

Software Essential Blocks Pro Type Plugin Vulnerable versions = 1.1.0 Fixed in 1.1.1 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-4386 Patch priority High CVSS severity High 8.3 Developer Claim ownership PSID b459be820fbe Credits Marco Wotschka Required privilege...

CVE-2023-39638

CVE-2023-39638 affects D-LINK DIR-859 A1 1.05 through A1 1.06B01 Beta01. A command injection exists in the lxmldbc_system function at the /htdocs/cgibin endpoint, linked to a failure to neutralize special elements, enabling remote arbitrary command execution. There is no public exploitation detai...

WordPress Slimstat Analytics Plugin <= 5.0.9 is vulnerable to SQL Injection

Software Slimstat Analytics Type Plugin Vulnerable versions = 5.0.9 Fixed in 5.0.10 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-4598 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 8c9d4c888c2a Credits WordFence Required privilege Contributor...

WordPress MyCryptoCheckout Plugin <= 2.125 is vulnerable to Cross Site Request Forgery (CSRF)

Software MyCryptoCheckout Type Plugin Vulnerable versions = 2.125 Fixed in 2.126 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-41693 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID ad222fa8439e Credits qilin99 Required...

WordPress WP Project Manager Plugin <= 2.6.0 is vulnerable to SQL Injection

Software WP Project Manager Type Plugin Vulnerable versions = 2.6.0 Fixed in 2.6.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-34383 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 02d3661940eb Credits Theodoros Malachias Required privilege...

WordPress Herd Effects Plugin < 5.2.4 is vulnerable to Cross Site Request Forgery (CSRF)

Software Herd Effects Type Plugin Vulnerable versions 5.2.4 Fixed in 5.2.4 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-4318 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3c6da81b7acf Credits Erwan LR WPScan Required...

The vulnerability of the FUN_00010824 function in D-Link DIR-880 A1 router microprogramming software allows a hacker to induce a service failure.

The vulnerability of the FUN00010824 function in D-Link DIR-880 A1 microprogrammed router software is related to pointer assignment errors. Exploiting this vulnerability could allow a malicious actor to cause service failure...

The vulnerability of the FUN_0001be68 function in D-Link DIR-880 A1 router’s microprogramming software allows a hacker to execute arbitrary code.

The vulnerability of the FUN0001be68 function in D-Link DIR-880 A1 microprogrammed router software is related to buffer overflow vulnerabilities. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the fgets function in D-Link DIR-880 A1 router software allows a hacker to execute arbitrary code.

The vulnerability of the fgets function in D-Link DIR-880 A1 router microprogramming software is related to buffer overflow vulnerabilities. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

D-Link DIR-880 安全漏洞

The D-Link DIR-880 is a router from China-based AUO D-Link. A security vulnerability exists in D-Link DIR-880 version A1FW107WWb08, which originates from a buffer overflow vulnerability in the function fgets...

CVE-2023-39671

Affected product: D-Link DIR-880 (A1_FW107WWb08) firmware. Issue: a buffer overflow in function FUN_0001be68. Reported as potentially exploitable remotely to execute arbitrary code. Impacts include high risk as per CVE-2023-39671. Remediation: PT-2023-4469 recommends temporarily disabling the FUN...

WordPress Demon image annotation Plugin <= 5.3 is vulnerable to SQL Injection

Software Demon image annotation Type Plugin Vulnerable versions = 5.3 Fixed in 5.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-40215 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 48d8f2dd0426 Credits LEE SE HYOUNG hackintoanetwork Required...

WordPress WordPress Job Board and Recruitment Plugin – JobWP Plugin <= 2.0 is vulnerable to Arbitrary File Upload

Software WordPress Job Board and Recruitment Plugin – JobWP Type Plugin Vulnerable versions = 2.0 Fixed in 2.1 OWASP Top 10 A1: Injection Classification Arbitrary File Upload CVE CVE-2023-29384 Patch priority High CVSS severity High 10 Developer Claim ownership PSID f62df9186ce4 Credits MyungJu K...

WordPress WPML String Translation Plugin <= 3.2.5 is vulnerable to SQL Injection

Software WPML String Translation Type Plugin Vulnerable versions = 3.2.5 Fixed in 3.2.6 OWASP Top 10 A1: Injection Classification SQL Injection CVE N/A Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 4eb8bfad344d Credits Stephen Required privilege Administrator Published 2...

WordPress Getnet Argentina para Woocommerce Plugin 0.0.1-0.0.4 is vulnerable to Broken Access Control

Software Getnet Argentina para Woocommerce Type Plugin Vulnerable versions 0.0.1-0.0.4 Fixed in 0.0.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-3525 Patch priority Low CVSS severity Low 7.5 Developer Claim ownership PSID 026805019331 Credits Kijam...

WordPress Coming Soon Plugin <= 1.5.9 is vulnerable to SQL Injection

Software Coming Soon Type Plugin Vulnerable versions = 1.5.9 Fixed in 1.6.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-46849 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 0a93f0e48b26 Credits Le Ngoc Anh Required privilege Administrator Publishe...

D-Link DAP-1325 Insecure Direct Object Reference

Exploit Title: D-Link DAP-1325 - Broken Access Control Date: 27-06-2023 Exploit Author: ieduardogoncalves Contact : twitter.com/0x00dia Vendor : www.dlink.com Version: Hardware version: A1 Firmware version: 1.01 Tested on:All Platforms 1 Description Security vulnerability known as "Unauthenticate...