D-Link DAP-1325 - Broken Access Control

Exploit Title: D-Link DAP-1325 - Broken Access Control Date: 27-06-2023 Exploit Author: ieduardogoncalves Contact : twitter.com/0x00dia Vendor : www.dlink.com Version: Hardware version: A1 Firmware version: 1.01 Tested on:All Platforms 1 Description Security vulnerability known as "Unauthenticate...

WordPress Post to CSV by BestWebSoft Plugin <= 1.4.0 is vulnerable to CSV Injection

Software Post to CSV by BestWebSoft Type Plugin Vulnerable versions = 1.4.0 Fixed in 1.4.1 OWASP Top 10 A1: Injection Classification CSV Injection CVE CVE-2023-36527 Patch priority Low CVSS severity Low 4.7 Developer Claim ownership PSID 7da5ccbd6441 Credits Mika Required privilege Author Publish...

The vulnerability of the microprogramming software of the D-Link DIR-809 A1 and D-Link DIR-809 A2 lies in the insufficient protection of registration data, allowing attackers to disclose the protected information.

The vulnerability of the microprogramming software of the D-Link DIR-809 A1 and D-Link DIR-809 A2 lies in the insufficient protection of registration data. Exploiting this vulnerability can allow a malicious actor to disclose the protected information...

WordPress Tutor LMS Plugin <= 2.2.0 is vulnerable to SQL Injection

Software Tutor LMS Type Plugin Vulnerable versions = 2.2.0 Fixed in 2.2.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-25800 Patch priority High CVSS severity High 8.1 Developer Claim ownership PSID 098051db4335 Credits Rafie Muhammad Patchstack Required privilege Student...

WordPress Tutor LMS Plugin <= 2.1.10 is vulnerable to SQL Injection

Software Tutor LMS Type Plugin Vulnerable versions = 2.1.10 Fixed in 2.2.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-25990 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID f1abc8ca80b8 Credits Rafie Muhammad Patchstack Required privilege Tutor...

The vulnerability of the microprogramming software of the D-Link DIR-809 A1 and D-Link DIR-809 A2 lies in the lack of authentication procedures. This allows attackers to circumvent existing security restrictions and download the configuration file.

The vulnerability of the microprogramming software of the D-Link DIR-809 A1 and D-Link DIR-809 A2 is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass existing security restrictions and download the configuration file remotely...

The vulnerability in the phpcgi.py script of the D-Link DIR-890L A1 router’s microprogramming software allows a hacker to bypass security restrictions and restore user credentials for accessing the system.

The vulnerability of the phpcgi.py script in the D-Link DIR-890L A1 router microprogramming system is related to deficiencies in authentication procedures. Exploiting this vulnerability allows a malicious actor to bypass security restrictions and restore access credentials to gain entry into the...

WordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL Injection

Software CM Pop-Up banners Type Plugin Vulnerable versions = 1.5.10 Fixed in 1.6.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-30750 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID a1957d5dbbe6 Credits Dave Jong Patchstack Required privilege...

CVE-2023-29856

D-Link DIR-868L Hardware version A1, firmware version 1.12 is vulnerable to Buffer Overflow. The vulnerability is in scandir.sgi binary...

Buffer overflow

UNSUPPORTED WHEN ASSIGNED D-Link DIR-868L Hardware version A1, firmware version 1.12 is vulnerable to Buffer Overflow. The vulnerability is in scandir.sgi binary...

WordPress WP Visitor Statistics (Real Time Traffic) Plugin < 6.9 is vulnerable to SQL Injection

Software WP Visitor Statistics Real Time Traffic Type Plugin Vulnerable versions 6.9 Fixed in 6.9 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0600 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 05f734351f7a Credits Trần Quốc Trường An Required...

Authentication flaw

D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass...

CVE-2023-30063

Affected product: D-Link DIR-890L, FW1.10 A1. The issue is an Authentication bypass vulnerability in the router, enabling unauthorized access via network. CVSSv3.1 base score 7.5 (HIGH) with C and I impacts high and none, respectively, per NVD. Root cause and exact vulnerable component are not de...

CVE-2023-30063

D-Link DIR-890L FW1.10 A1 is vulnerable to Authentication bypass...

WordPress Customizer Export/Import Plugin < 0.9.6 is vulnerable to PHP Object Injection

Software Customizer Export/Import Type Plugin Vulnerable versions 0.9.6 Fixed in 0.9.6 OWASP Top 10 A1: Injection Classification PHP Object Injection CVE CVE-2023-1347 Patch priority Low CVSS severity Low 4.4 Developer Claim ownership PSID 014e99d7d277 Credits Nguyen Huu Do Required privilege...

WordPress Booking calendar, Appointment Booking System Plugin <= 3.2.7 is vulnerable to SQL Injection

Software Booking calendar, Appointment Booking System Type Plugin Vulnerable versions = 3.2.7 Fixed in 3.2.8 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2022-47428 Patch priority Low CVSS severity Low 6.7 Developer Claim ownership PSID be3286ef939c Credits thiennv Required...

CVE-2022-40946

On D-Link DIR-819 Firmware Version 1.06 Hardware Version A1 devices, it is possible to trigger a Denial of Service via the systoken parameter in a cgi-bin/webproc?getpage=html/index.html request...

WordPress Quiz And Survey Master Plugin <= 8.1.4 is vulnerable to SQL Injection

Software Quiz And Survey Master Type Plugin Vulnerable versions = 8.1.4 Fixed in 8.1.5 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-28787 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 34ea65c01c78 Credits Rafie Muhammad Patchstack Required...

WordPress Gallery Plugin < 4.7.0 is vulnerable to SQL Injection

Software Gallery Type Plugin Vulnerable versions 4.7.0 Fixed in 4.7.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0765 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID 85ca584ad7e5 Credits dc11 Required privilege Author Published 12 April, 2023...

DLink DIR 819 A1 - Denial of Service

Exploit Title: DLink DIR 819 A1 - Denial of Service Date: 30th September, 2022 Exploit Author: @whokilleddb https://twitter.com/whokilleddb Vendor Homepage: https://www.dlink.com/en/products/dir-819-wireless-ac750-dual-band-router Version: DIR-819 Firmware Version : 1.06 Hardware Version : A1...