432 matches found
CVE-2022-27858
CVE-2022-27858 refers to a CSV injection vulnerability in the WordPress plugin Activity Log (Team Activity Log) versions ≤ 2.8.3. The weakness stems from the plugin not validating data before exporting to CSV, enabling injection in CSV fields. Impact is described as CSV injection; remediation is ...
CVE-2022-27858 WordPress Activity Log plugin <= 2.8.3 - CSV Injection vulnerability
CSV Injection vulnerability in Activity Log Team Activity Log = 2.8.3 on WordPress...
PT-2022-18645 · WordPress · Activity Log Team Activity Log
Name of the Vulnerable Software and Affected Versions: Activity Log Team Activity Log versions 2.8.3 and earlier Description: A CSV Injection issue has been identified. This issue affects the Activity Log Team Activity Log plugin on WordPress. Recommendations: For versions 2.8.3 and earlier, upda...
WordPress plugin Activity Log 注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...
WordPress Activity Log plugin <= 2.8.3 - CSV Injection vulnerability
CSV Injection vulnerability discovered by Universe Patchstack Alliance in WordPress Activity Log plugin versions = 2.8.3 Solution Update the WordPress Activity Log plugin to the latest available version at least 2.8.4...
CVE-2022-27858
CSV Injection vulnerability in Activity Log Team Activity Log = 2.8.3 on WordPress...
WordPress WP Activity Log plugin < 4.4.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress WP Activity Log plugin versions 4.4.0. Solution Update the WordPress WP Activity Log plugin to the latest available version at least 4.4.0...
WordPress Activity Log For MainWP plugin <= 1.7.0 - Toggle The Debug Mode via Cross-Site Request Forgery (CSRF) vulnerability
Toggle The Debug Mode via Cross-Site Request Forgery CSRF vulnerability discovered in WordPress Activity Log For MainWP plugin versions = 1.7.0. Solution Update the WordPress Activity Log For MainWP plugin to the latest available version at least 1.7.1...
WordPress WP Activity Log plugin < 4.4.0 - Sensitive Information Disclosure vulnerability
Sensitive Information Disclosure vulnerability discovered in WordPress WP Activity Log plugin versions 4.4.0. Solution Update the WordPress WP Activity Log plugin to the latest available version at least 4.4.0...
Fuel CMS 1.4.13 - (col) Blind SQL Injection Vulnerability
Exploit Title: Fuel CMS 1.4.13 - 'col' Blind SQL Injection Authenticated Exploit Author: Rahad Chowdhury Vendor Homepage: https://www.getfuelcms.com/ Software Link: https://github.com/daylightstudio/FUEL-CMS/archive/1.4.13.zip Version: 1.4.13 Tested on: Kali Linux, PHP 7.4.16, Apache 2.4.46 Steps...
User Activity Log < 1.4.7 - Reflected Cross-Site Scripting
The plugin does not escape the txtsearch parameter before outputting it in an attribute, leading to a Reflected Cross-Site Scripting issue https://example.com/wp-admin/admin.php?page=useractionlog&txtsearch=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2FXSS%2F%29%2F%2F...
User Activity Log < 1.4.7 - Reflected Cross Site Scripting via Query String
The plugin does not escape the $SERVER'QUERYSTRING' before outputting it back in attributes, which could lead to Reflected Cross-Site Scripting in web browsers which do not encode URL characters. With a web browser which does not encode characters or use burp suite and decode the URL via the...
User Activity Log < 1.4.7 - Reflected Cross-Site Scripting
The plugin does not escape the txtsearch parameter before outputting it in an attribute, leading to a Reflected Cross-Site Scripting issue PoC https://example.com/wp-admin/admin.php?page=useractionlog=%22+style%3Danimation-name%3Arotation+onanimationstart%3Dalert%28%2FXSS%2F%29%2F%2F...
Activity Log < 2.7.0 - Authenticated SQL Injection
The plugin was vulnerable to SQL Injection in the order column of the past events table. time curl 'http://www.example.com/wp-admin/admin.php?page=activitylogpage&orderby=histtime%20AND%20SLEEP%280%29' -H 'Cookie: ...'...
WordPress Activity Log plugin <= 2.6.1 - Authenticated SQL Injection (SQLi) vulnerability
Authenticated SQL Injection SQLi vulnerability discovered by Synacktiv in WordPress Activity Log plugin versions = 2.6.1. Solution Update the WordPress Activity Log plugin to the latest available version at least 2.7.0...
WordPress WP Activity Log plugin <= 4.1.4 - SQL Injection (SQLi) in External Database Module vulnerability
SQL Injection SQLi in External Database Module vulnerability found by WP deeply in WordPress WP Activity Log plugin versions = 4.1.4 . Solution Update the WordPress WP Activity Log plugin to the latest available version at least 4.1.5...
WordPress aryo-activity-log plugin cross-site scripting vulnerability (CNVD-2019-32409)
WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. aryo-activity-log is a weblog plugin used in it. A cross-site scripting vulnerability exists in the WordPress aryo-activity-log...
WordPress aryo-activity-log plugin cross-site scripting vulnerability
WordPress is the WordPress Foundation's set of blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. aryo-activity-log is a weblog plugin used in it. A cross-site scripting vulnerability exists in the WordPress aryo-activity-log...
