CVE-2024-2954

The Action Network plugin for WordPress is vulnerable to SQL Injection via the 'bulk-action' parameter in version 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, wit...

CVE-2024-2954

CVE-2024-2954 affects the Action Network WordPress plugin (version 1.4.3) and is due to insufficient escaping of the bulk-action parameter, enabling an authenticated attacker with administrator-level access or higher to inject arbitrary SQL into existing queries. This could lead to extraction of ...

CVE-2024-2954: Improper Neutralization of Special Elements used in an SQL Command

The Action Network plugin for WordPress is vulnerable to SQL Injection via the 'bulk-action' parameter in version 1.4.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, wit...

WordPress Plugin Action Network 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

PT-2024-18088 · WordPress · Sms Alert Order Notifications

Name of the Vulnerable Software and Affected Versions: SMS Alert Order Notifications – WooCommerce plugin for WordPress versions up to, and including, 3.6.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the processBulkAction...

WooCommerce Product Filter < 1.4.4 - Filter Deletion via CSRF

Description The plugin does not have CSRF check in its bulk action, which could allow attackers to make logged in users delete arbitrary filters via CSRF attack, granted they know the related filter slugs PoC Make a logged in admin open the URL below to make them delete the filter with the slug...

PT-2024-14929 · WordPress · The Master Slider

Name of the Vulnerable Software and Affected Versions: The Master Slider – Responsive Touch Slider plugin for WordPress versions up to, and including, 3.9.3 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the process bulk action...

CVE-2024-0859

The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or incorrect nonce validation on the processbulkaction function in ListAffiliatesTable.php. This makes it possible for unauthenticated...

Cross site request forgery (csrf)

The Affiliates Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.9.34. This is due to missing or incorrect nonce validation on the processbulkaction function in ListAffiliatesTable.php. This makes it possible for unauthenticated...

WordPress plugin Advanced Database Cleaner security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed using the PHP language, which supports personal blogs on PHP and MySQL servers.WordPress plugin is an...

PT-2024-15872 · WordPress · Affiliates Manager

Name of the Vulnerable Software and Affected Versions: Affiliates Manager plugin for WordPress versions up to, and including, 2.9.34 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the process bulk action function in...

GHSA-FC75-58R8-RM3H Wagtail vulnerable to disclosure of user names via admin bulk action views

Impact A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user...

Wagtail vulnerable to disclosure of user names via admin bulk action views

Impact A user with a limited-permission editor account for the Wagtail admin can make a direct URL request to the admin view that handles bulk actions on user accounts. While authentication rules prevent the user from making any changes, the error message discloses the display names of user...

WordPress Plugin Page Builder: KingComposer 代码问题漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress is a blogging platform developed in the PHP language that supports personal blogs on PHP and MySQL servers.WordPress plugin is an application...

SQL injection through marking blog comments on bulk as spam

Description the comments ids aren't checked and vulnerable for SQL injection Proof of Concept...

CVE-2021-24704

In the Orange Form WordPress plugin through 1.0, the processbulkaction function in "admin/orange-form-email.php" performs an unprepared SQL query with an unsanitized parameter $id. Only admin can access the page that invokes the function, but because of lack of CSRF protection, it is actually...

AdRotate < 5.8.22 - Admin+ SQL Injection

The plugin does not sanitise and escape the adrotateaction before using it in a SQL statement via the adrotaterequestaction function available to admins, leading to a SQL injection Get the nonce from one of the bulk action, for example /wp-admin/admin.php?page=adrotate and look for adrotatenonce ...

Privilege Escalation

otrs2 is vulnerable to privilege escalation. The vulnerability exists due to the lack of permission in the bulk action screen...

CVE-2021-21443: Exposure of Sensitive Information to an Unauthorized Actor

Agents are able to list customer user emails without required permissions in the bulk action screen. This issue affects: OTRS AG OTRS Community Edition: 6.0.x version 6.0.1 and later versions. OTRS AG OTRS: 7.0.x versions prior to 7.0.27...

PT-2021-6460 · Otrs Ag +1 · Otrs +2

Name of the Vulnerable Software and Affected Versions: OTRS AG OTRS Community Edition versions 6.0.1 and later OTRS AG OTRS versions prior to 7.0.27 Description: The issue is related to errors in permission handling in the OTRS ticket system, allowing an attacker to remotely access confidential...