PT-2019-8479

Name of the Vulnerable Software and Affected Versions WordPress invite-anyone plugin versions prior to 1.3.16 Description The issue arises from incorrect escaping of untrusted input in both the Dashboard and front-end of the WordPress invite-anyone plugin. Recommendations For versions prior to...

CVE-2017-18543: Improper Access Control

The invite-anyone plugin before 1.3.16 for WordPress has incorrect access control for email-based invitations...

PT-2019-8478

Name of the Vulnerable Software and Affected Versions WordPress invite-anyone plugin versions prior to 1.3.16 Description The issue allows for admin-panel CSRF, which can be exploited through the WordPress invite-anyone plugin. Recommendations For versions prior to 1.3.16, update the invite-anyon...

WordPress Invite Anyone plugin <=1.3.18 - Unauthenticated PHP Object Injection vulnerability

Unauthenticated PHP Object Injection vulnerability found in WordPress Invite Anyone plugin versions =1.3.18. Solution Update the WordPress Invite Anyone plugin to the latest available version at least version 1.3.19...

WordPress Invite Anyone plugin <=1.3.15 - Cross-Site Request Forgery (CSRF)/Cross-Site Scripting (XSS) Vulnerability

WordPress Invite Anyone plugin Cross-Site Request Forgery CSRF and Cross-Site Scripting XSS vulnerabilities were found in 1.3.15 version. The settings are passed without any sanitization to function registersetting. Solution Update the plugin...

WordPress Invite Anyone Plugin Security Bypass Vulnerability

WordPress is the WordPress Software Foundation's suite of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.Invite Anyone is one of the invitation components. A security bypass vulnerability exists in the by-email/by-email.php...

Code injection

An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack...

CVE-2017-6955

An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack...

CVE-2017-6955

An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack...

CVE-2017-6955

The CVE-2017-6955 vulnerability affects the WordPress plugin Invite Anyone, specifically by-email/by-email.php in versions prior to 1.3.15. An authenticated or sufficient-privileges user can modify the subject and body of the invitation email, which should be immutable, facilitating social engine...

Invite Anyone <= 1.3.14 - Change of Email Invitation Content

The Invite Anyone WordPress plugin was affected by a Change of Email Invitation Content security vulnerability...

PT-2017-17422

Name of the Vulnerable Software and Affected Versions Invite Anyone plugin versions prior to 1.3.15 Description A security issue was found in the Invite Anyone plugin for WordPress, where a user can modify the subject and body of invitation emails, which are supposed to be unchangeable. This allo...

CVE-2017-6955: Improper Input Validation

An issue was discovered in by-email/by-email.php in the Invite Anyone plugin before 1.3.15 for WordPress. A user is able to change the subject and the body of the invitation mail that should be immutable, which facilitates a social engineering attack...

osCommerce Unprotected Admin Directory

The installation of osCommerce on the remote host apparently lets anyone access the application's admin directory, which means that they have complete administrative access to the site. %NASLMINLEVEL 70300 C Tenable Network Security, Inc. include'deprecatednasllevel.inc'; include'compat.inc'; if...