74 matches found
WordPress Invite Anyone plugin <= 1.4.7 - Reflected Cross Site Scripting (XSS) vulnerability
Reflected Cross Site Scripting XSS vulnerability discovered by Dimas Maulana Patchstack Alliance in WordPress Plugin Invite Anyone versions = 1.4.7...
WordPress Invite Anyone Plugin <= 1.4.7 is vulnerable to Cross Site Scripting (XSS)
Software Invite Anyone Type Plugin Vulnerable versions = 1.4.7 Fixed in 1.4.8 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2024-43327 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID e990de812727 Credits Dimas Maulana Required privilege...
Malicious code in anyone-deps (npm)
--- -= Per source details. Do not edit below this line.=-...
MAL-2024-1759 Malicious code in anyone-deps (npm)
--- -= Per source details. Do not edit below this line.=-...
Pie Register <= 3.8.3.1 - Unauthenticated Arbitrary File Upload
Description The Pie Register plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the piesaveregistration function in versions up to, and including, 3.8.3.1. This makes it possible for unauthenticated attackers to upload arbitrary files on the affect...
StandardizedToken can be setup multiple times by anyone. Causing unlimited mint by anyone.
Lines of code Vulnerability details Impact StandardizedToken can be setup multiple times by anyone. Causing unlimited mint by anyone. Proof of Concept function setupbytes calldata params external override onlyProxy address distributor; address tokenManager; string memory tokenName; tokenManager,...
sendAllocatedYETI() can be called by anyone
Handle jayjonah8 Vulnerability details Impact In TeamAllocation.sol, the sendAllocatedYETI function simply distributes YETI to the team. This is a transfer of value and it currently can be called by anyone as the onlyTeam modifier is not used here. Proof of Concept Tools Used Manual code review...
WordPress invite-anyone plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. invite-anyone is an invitation notification plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...
WordPress invite-anyone plugin input validation error vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. invite-anyone is an invitation notification plugin used in it. An input validation error vulnerability exists in the WordPress...
CVE-2017-18543
The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations...
CVE-2017-18545
The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input...
CVE-2017-18544
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF...
CVE-2017-18543
The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations...
CVE-2017-18543
The CVE-2017-18543 entry concerns the WordPress plugin Invite Anyone, specifically versions before 1.3.16, which has incorrect access control for email-based invitations. The vulnerability is supported by multiple connected sources that describe the plugin’s access-control flaw, its impact, and t...
CVE-2017-18544
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF...
CVE-2017-18544
The invite-anyone plugin before 1.3.16 for WordPress has admin-panel CSRF...
CVE-2017-18545
The invite-anyone plugin before 1.3.16 for WordPress has incorrect escaping of untrusted Dashboard and front-end input...
PT-2019-8478
Name of the Vulnerable Software and Affected Versions WordPress invite-anyone plugin versions prior to 1.3.16 Description The issue allows for admin-panel CSRF, which can be exploited through the WordPress invite-anyone plugin. Recommendations For versions prior to 1.3.16, update the invite-anyon...
