CVE-2022-3856

The Comic Book Management System WordPress plugin before 2.2.0 does not sanitize and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as Admin...

CVE-2022-3426

The Advanced WP Columns WordPress plugin through 2.0.6 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfilteredhtml capability is disallowed for example in multisite setup...

CVE-2022-3926

The CVE-2022-3926 issue affects the WP OAuth Server (OAuth Authentication) WordPress plugin, versions prior to 3.4.2. The root cause is a missing CSRF check when regenerating secrets, which could let an attacker who is logged in and knows a client ID trigger a secret regeneration for any client. ...

VulnCheck KEV: CVE-2017-16562

The UserPro plugin before 4.9.17.1 for WordPress, when used on a site with the "admin" username, allows remote attackers to bypass authentication and obtain administrative access via a "true" value for the upautolog parameter in the QUERYSTRING to the default URI...

PT-2022-21343 · WordPress · Wp Csv Exporter

Name of the Vulnerable Software and Affected Versions: WP CSV Exporter WordPress plugin versions prior to 1.3.7 Description: The issue allows high privilege users, such as admins, to perform SQL injection attacks due to improper sanitization and escaping of some parameters before using them in a...

PT-2022-26288 · WordPress · Chained Quiz

Name of the Vulnerable Software and Affected Versions: Chained Quiz plugin for WordPress versions up to, and including, 1.3.2.2 Description: The issue arises from insufficient input sanitization and output escaping, allowing authenticated attackers with administrative privileges to inject arbitra...

CVE-2022-43463

Auth. admin+ Stored Cross-Site Scripting XSS vulnerability in Custom Product Tabs for WooCommerce plugin = 1.7.9 on WordPress...

CVE-2022-3859

An uncontrolled search path vulnerability exists in Trellix Agent TA for Windows in versions prior to 5.7.8. This allows an attacker with admin access, which is required to place the DLL in the restricted Windows System folder, to elevate their privileges to System by placing a malicious DLL ther...

Design/Logic Flaw

An uncontrolled search path vulnerability exists in Trellix Agent TA for Windows in versions prior to 5.7.8. This allows an attacker with admin access, which is required to place the DLL in the restricted Windows System folder, to elevate their privileges to System by placing a malicious DLL ther...

CVE-2022-3859

An uncontrolled search path vulnerability exists in Trellix Agent TA for Windows in versions prior to 5.7.8. This allows an attacker with admin access, which is required to place the DLL in the restricted Windows System folder, to elevate their privileges to System by placing a malicious DLL ther...

CVE-2022-44097

Book Store Management System v1.0 was discovered to contain hardcoded credentials which allows attackers to escalate privileges and access the admin panel...

CVE-2022-3897

The WP Affiliate Platform plugin for WordPress is vulnerable to Stored Cross-Site Scripting via several parameters in versions up to, and including, 6.3.9 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level...

CVE-2022-44037

An access control issue in APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software V4.1NA, V3.11.4, W2.1NA, V4.1SAA, C1.2.2 allows attackers to access sensitive data and execute specific commands and functions with full admin rights without authenticating allows him to perform multiple...

PT-2022-21873 · WordPress · Ultimate Member

Name of the Vulnerable Software and Affected Versions: The Ultimate Member plugin for WordPress versions up to, and including, 2.5.0 Description: The issue allows for Remote Code Execution via the get option value from callback function, which accepts user-supplied input and passes it through cal...

Menu Item Visibility Control <= 0.5 - Admin+ Arbitrary PHP Code Execution

The plugin doesn't sanitize and validate the "Visibility logic" option for WordPress menu items, which could allow highly privileged users to execute arbitrary PHP code even in a hardened environment. 1. As an admin, go to "Appearance - Menus" and create a menu with some items of your choice. 2. ...

CVE-2022-3848

The WP User Merger WordPress plugin before 1.5.3 does not properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection exploitable by users with a role as low as admin...

PT-2022-7248 · Apsystems · Apsystems Energy Communication Unit (Ecu-C) Power Control

Name of the Vulnerable Software and Affected Versions: APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software versions V3.11.4, V4.1NA, V4.1SAA, W2.1NA, C1.2.2 Description: An access control issue in the APsystems ENERGY COMMUNICATION UNIT ECU-C Power Control Software allows attackers t...

PT-2022-24425 · WordPress · Wp User Merger

Name of the Vulnerable Software and Affected Versions: WP User Merger WordPress plugin versions prior to 1.5.3 Description: The issue arises from the plugin's failure to properly sanitise and escape a parameter before using it in a SQL statement, leading to a SQL injection. This can be exploited ...

PT-2022-24292 · WordPress · Donations Via Paypal

Name of the Vulnerable Software and Affected Versions: Donations via PayPal WordPress plugin versions prior to 1.9.9 Description: The issue allows high privilege users, such as admins, to perform Stored Cross-Site Scripting attacks, even when the unfiltered html capability is disallowed, for...

CVE-2022-2513

A vulnerability exists in the Intelligent Electronic Device IED Connectivity Package ConnPack credential storage function in Hitachi Energy’s PCM600 product included in the versions listed below, where IEDs credentials are stored in a cleartext format in the PCM600 database and logs files. An...