47 matches found
WordPress All-In-One Security (AIOS) plugin < 5.5.0 - Subscriber+ 2FA Bypass vulnerability
Subscriber+ 2FA Bypass vulnerability discovered by Karol Czubernat in WordPress Plugin All In One WP Security & Firewall versions 5.5.0...
CVE-2026-111739 Two Factor Authentication < 1.17.0 and All-In-One Security (AIOS) < 5.5.0 - Subscriber+ 2FA Bypass via 'creds_user_id' Parameter
The Two Factor Authentication WordPress plugin before 1.17.0, All-In-One Security AIOS WordPress plugin before 5.5.0 do not bind the account whose two-factor code is verified to the account being authenticated, allowing an attacker who knows a victim's password and holds their own...
CVE-2023-0156
CVE ID : CVE-2023-0156 Vulnerability Type : Directory Traversal Description : The All-In-One Security AIOS plugin for WordPress is vulnerable to directory traversal in versions up to, and including, 5.1.4. This allows authenticated attackers with administrator-level permissions to read the conten...
ai-agents (>=0.0.4, <=0.0.52), aiflows (>=0.1.5, <=1.1.1) +16 more potentially affected by CVE-2024-5710 via litellm (>=1.0.0, <=1.14.4)
litellm PYPI version =1.0.0, =0.0.4, =0.1.5, =2.5.8, =2.5.8, =2.7.3, =0.7.0, =2.2.9, =0.4.7, =0.1.22, =0.1.0, =1.9.1, =1.10.1 and more Source cves: CVE-2024-5710 Source advisory: OSV:PYSEC-2026-1551...
CVE-2026-8438
The All-In-One Security (AIOS) WordPress plugin (versions up to and including 5.4.7) is affected by a Stored Cross-Site Scripting vulnerability. The root cause is insufficient input sanitization in get_rest_route() and missing output escaping in the debug log’s column_default() when the admin das...
CVE-2026-8438: Improper Neutralization of Input During Web Page Generation
The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to and including 5.4.7. This is due to insufficient input sanitization in the getrestroute function and missing output escaping in the columndefault method of the...
EUVD-2022-51699
Malicious code in bioql PyPI...
aios-core (>=0.0.1b1, <=0.0.1b2), flute-kernel (>=0.2.6, <=0.4.1) +1 more potentially affected by CVE-2025-48887 via vllm (0.5.4)
vllm PYPI version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - aios-core =0.0.1b1, =0.2.6, =0.5.4.0, =0.5.4.1 Source cves: CVE-2025-48887 Source advisory: OSV:PYSEC-2025-50...
CVE-2022-4097
The All-In-One Security AIOS WordPress plugin before 5.0.8 is susceptible to IP Spoofing attacks, which can lead to bypassed security features like IP blocks, rate limiting, brute force protection, and more...
CVE-2022-4346
The All-In-One Security AIOS WordPress plugin before 5.1.3 leaked settings of the plugin publicly, including the used email address...
aios-core (>=0.0.1b1, <=0.0.1b2), flute-kernel (>=0.2.6, <=0.4.1) +1 more potentially affected by CVE-2025-32444 via vllm (0.5.4)
vllm PYPI version 0.5.4 is affected by a known vulnerability. The following packages have a transitive dependency on vllm and may be impacted: - aios-core =0.0.1b1, =0.2.6, =0.5.4.0, =0.5.4.1 Source cves: CVE-2025-32444 Source advisory: OSV:PYSEC-2025-42...
aana (>=0.2.1, <=0.2.2.2), acai-swarm (0.1.0) +68 more potentially affected by CVE-2025-25183 via vllm (>=0.1.3, <=0.7.0)
vllm PYPI version =0.1.3, =0.2.1, =0.0.1b1, =0.2.4, =0.1.0, =0.1.15rc1, =0.0.1, =0.0.3, =0.2.13, =0.1.0, =0.1.0a0, =0.1.2, =0.2.24 and more Source cves: CVE-2025-25183 Source advisory: GHSA-RM76-4MRF-V9R8...
ai-agents (>=0.0.4, <=0.0.52), aiflows (>=0.1.5, <=1.1.1) +16 more potentially affected by CVE-2024-5225 via litellm (>=1.0.0, <=1.14.4)
litellm PYPI version =1.0.0, =0.0.4, =0.1.5, =2.5.8, =2.5.8, =2.7.3, =0.7.0, =2.2.9, =0.4.7, =0.1.22, =0.1.0, =1.9.1, =1.10.1 and more Source cves: CVE-2024-5225 Source advisory: OSV:GHSA-H6M6-JJ8V-94JJ...
CVE-2023-52147 WordPress All-In-One Security (AIOS) plugin <= 5.2.4 - Secret Login Page Location Disclosure on Multisites vulnerability
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects All In One WP Security & Firewall: from n/a through 5.2.4...
CVE-2023-52147 WordPress All-In-One Security (AIOS) plugin <= 5.2.4 - Secret Login Page Location Disclosure on Multisites vulnerability
Exposure of Sensitive Information to an Unauthorized Actor vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects All In One WP Security & Firewall: from n/a through 5.2.4...
All In One WP Security < 5.2.7 - Cross-Site Request Forgery to IP Blocking
Description The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 5.2.6. This is due to missing or incorrect nonce validation on the render404detection function. This makes it possible for...
CVE-2024-30468 WordPress All-In-One Security (AIOS) – Security and Firewall plugin <= 5.2.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall.This issue affects All In One WP Security & Firewall: from n/a through 5.2.6...
CVE-2024-30468 WordPress All-In-One Security (AIOS) – Security and Firewall plugin <= 5.2.6 - Cross Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability in All In One WP Security & Firewall Team All In One WP Security & Firewall.This issue affects All In One WP Security & Firewall: from n/a through 5.2.6...
CVE-2024-1037
The All-In-One Security AIOS – Security and Firewall plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via the 'tab' parameter in all versions up to, and including, 5.2.5 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...