264 matches found
PT-2023-12519 · WordPress · Custom Banners
Name of the Vulnerable Software and Affected Versions: Custom Banners plugin for WordPress versions up to and including 3.2.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the saveCustomFields function. This allows unauthenticated...
WordPress CM Pop-Up banners Plugin <= 1.5.10 is vulnerable to SQL Injection
Software CM Pop-Up banners Type Plugin Vulnerable versions = 1.5.10 Fixed in 1.6.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-30750 Patch priority High CVSS severity High 8.5 Developer Claim ownership PSID a1957d5dbbe6 Credits Dave Jong Patchstack Required privilege...
Sql injection
The WP Popup Banners WordPress Plugin, version = 1.2.5, is affected by an authenticated SQL injection vulnerability in the 'value' parameter in the getpopupdata action...
CVE-2023-28661
CVE-2023-28661 concerns the WordPress plugin WP Popup Banners (versions ≤ 1.2.5). The vulnerability is an authenticated SQL injection in the get_popup_data action via the value parameter. It is documented as affecting the plugin with a CVSS v3.1 score of 8.8 (High) and impact on confidentiality, ...
WP Popup Banners <= 1.2.5 - Subscriber+ SQLi
The plugin does not properly sanitise and escape the value parameter before using it in a SQL statement via the getpopupdata AJAX action, leading to a SQL injection exploitable by any authenticated users, such as subscriber Run the below command in the developer console of the web browser while...
WordPress Plugin WP Popup Banners SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...
WordPress WP Popup Banners Plugin <= 1.2.5 is vulnerable to SQL Injection
Software WP Popup Banners Type Plugin Vulnerable versions = 1.2.5 Fixed in N/A OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-1471 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 0e757b087b40 Credits Etan Imanol Castro Aldrete Required privilege...
CVE-2023-1471 WP Popup Banners <= 1.2.5 - Authenticated (Subscriber+) SQL Injection
The WP Popup Banners plugin for WordPress is vulnerable to SQL Injection via the 'bannerid' parameter in versions up to, and including, 1.2.5 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for...
CVE-2023-1471
CVE-2023-1471 concerns the WordPress plugin WP Popup Banners up to version 1.2.5 . The vulnerability is an SQL Injection via the banner_id parameter caused by insufficient escaping and inadequate query preparation. An authenticated attacker with minimal privileges (e.g., a subscriber) can inject ...
WordPress plugin WP Popup Banners SQL注入漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WP Popup...
TikTok Fined $5.4 Million by French Regulator for Violating Cookie Laws
Popular short-form video hosting service TikTok has been fined €5 million about $5.4 million by the French data protection watchdog for breaking cookie consent rules, making it the latest platform to face similar penalties after Amazon, Google, Meta, and Microsoft since 2020. "Users of 'tiktok.co...
Adult popunder campaign used in mainstream ad fraud scheme
This blog post was authored by Jerome Segura Online advertising is a multi billion dollar industry with projected spending to reach over 600 billion U.S. dollars for 2022. It's not surprising that criminals are trying their hardest to abuse this ecosystem in any way that they can. One of the...
Fedora: Security Advisory for golang-github-mbndr-figlet4go (FEDORA-2022-3e1ade35db)
The remote host is missing an update for the Copyright C 2022 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can...
[SECURITY] Fedora 36 Update: golang-github-mbndr-figlet4go-0-0.8.20191009gitd6cef5b.fc36
figlet4go is a go library which is a port of FIGlet to Golang. With figlet4go it's easy to create ascii text banners in the command-line or with the given api...
Design/Logic Flaw
Discourse is an open-source discussion platform. Prior to version 2.8.4 in the stable branch and version 2.9.0.beta5 in the beta and tests-passed branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the stable branch and version 2.9.0.beta5 in...
CVE-2022-31060 Banner topic data is exposed on login-required Discourse sites
Discourse is an open-source discussion platform. Prior to version 2.8.4 in the stable branch and version 2.9.0.beta5 in the beta and tests-passed branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the stable branch and version 2.9.0.beta5 in...
CVE-2022-31060 Banner topic data is exposed on login-required Discourse sites
Discourse is an open-source discussion platform. Prior to version 2.8.4 in the stable branch and version 2.9.0.beta5 in the beta and tests-passed branches, banner topic data is exposed on login-required sites. This issue is patched in version 2.8.4 in the stable branch and version 2.9.0.beta5 in...
Cross site request forgery (csrf)
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form...
CVE-2022-1694 Useful Banner Manager <= 1.6.1 - Modify banners via CSRF
The Useful Banner Manager WordPress plugin through 1.6.1 does not perform CSRF checks on POST requests to its admin page, allowing an attacker to trick a logged in admin to add, modify or delete banners from the plugin by submitting a form...
