CVE-2023-4631

CVE ID : CVE-2023-4631 취약점 유형 : IP 주소 스푸핑 설명 : DoLogin Security WordPress 플러그인은 버전 3.6 이하에서 IP 주소 스푸핑에 취약합니다. 이는 요청 로깅 및 로그인 제한을 위해 IP 주소 정보를 가져오는 위치에 대한 제한이 충분하지 않기 때문입니다. 공격자는 X-Forwarded-For 헤더에 다른 IP 주소를 제공하여 로그에 기록되도록 할 수 있으며, 이를 통해 로그인을 차단하도록 설정된 IP 주소를 우회하는 데 사용될 수 있습니다. 재현 단계 : 1...

CVE-2023-4549

CVE ID : CVE-2023-4549 취약점 유형 : 크로스 사이트 스크립팅XSS 설명 : WordPress용 DoLogin Security 플러그인은 3.6 이하 버전에서 'X-Forwarded-For' 헤더를 통한 저장형 크로스 사이트 스크립팅XSS 취약점이 존재합니다. 이는 불충분한 입력 삭제sanitization 및 출력 이스케이핑escaping 때문입니다. 이로 인해 인증되지 않은 공격자가 페이지에 임의의 웹 스크립트를 주입할 수 있으며, 사용자가 주입된 페이지에 접근할 때마다 해당 스크립트가 실행됩니다. 재현 절...

CVE-2023-4800

CVE 编号: CVE-2023-4800 漏洞类型: 敏感数据暴露 描述: 适用于 WordPress 的 DoLogin Security 插件在 3.7 及更早版本中，由于仪表盘小工具缺少权限检查，存在未授权访问数据的漏洞。这使得已认证的攻击者能够查看登录尝试日志。 复现步骤: 启用插件，并以授权用户身份导航到仪表盘。 参考: 1. https://wpscan.com/vulnerability/7eae1434-8c7a-4291-912d-a4a07b73ee56 2. https://vulners.com/cve/CVE-2023-4800 3...

CVE-2026-14495 DoLogin Security <= 4.3 - Unauthenticated Authentication Bypass via Insufficient Randomness via 'dologin' Parameter Weak PRNG Token

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because dologin\s::rrand seeds the Mersenne Twister with mtsranddouble microtime 1000000 — discarding the integer-second...

EUVD-2026-42167

The DoLogin Security plugin for WordPress is vulnerable to Authentication Bypass via Insufficient Randomness in all versions up to, and including, 4.3. The vulnerability exists because dologin\s::rrand seeds the Mersenne Twister with mtsranddouble microtime 1000000 — discarding the integer-second...

CVE-2023-4549

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form...

EUVD-2023-50810

Malicious code in bioql PyPI...

CVE-2023-46608

Missing Authorization vulnerability in WPDO DoLogin Security dologin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DoLogin Security: from n/a through = 3.7.1...

CVE-2023-46608

Missing Authorization vulnerability in WPDO DoLogin Security dologin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DoLogin Security: from n/a through = 3.7.1...

CVE-2023-46608 WordPress DoLogin Security plugin <= 3.7.1 - Multiple Broken Access Control vulnerability

Missing Authorization vulnerability in WPDO DoLogin Security dologin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DoLogin Security: from n/a through = 3.7.1...

CVE-2023-46608 WordPress DoLogin Security plugin <= 3.7.1 - Multiple Broken Access Control vulnerability

Missing Authorization vulnerability in WPDO DoLogin Security dologin allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects DoLogin Security: from n/a through = 3.7.1...

WordPress plugin DoLogin Security 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability...

DoLogin Security <= 3.7.1 - Missing Authorization via REST Endpoints

Description The DoLogin Security plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on multiple REST functions in versions up to, and including, 3.7.1. This makes it possible for unauthenticated attackers to send test SMS messages to arbitrar...

WordPress DoLogin Security Plugin <= 3.7.1 is vulnerable to Broken Access Control

Software DoLogin Security Type Plugin Vulnerable versions = 3.7.1 Fixed in 3.8 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-46608 Patch priority Medium CVSS severity Medium 5.3 Developer Claim ownership PSID 5adc7395b967 Credits Mika Required privilege...

WordPress DoLogin Security Plugin < 3.7.1 is vulnerable to Sensitive Data Exposure

Software DoLogin Security Type Plugin Vulnerable versions 3.7.1 Fixed in 3.7.1 OWASP Top 10 A3: Sensitive Data Exposure Classification Sensitive Data Exposure CVE CVE-2023-4800 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 3a18978f1a90 Credits Bartlomiej Marek and Tomasz...

CVE-2023-4800

The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users...

CVE-2023-4800 DoLogin Security < 3.7.1 - Subscriber+ IP Address leak

The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users...

CVE-2023-4800 DoLogin Security < 3.7.1 - Subscriber+ IP Address leak

The DoLogin Security WordPress plugin before 3.7.1 does not restrict the access of a widget that shows the IPs of failed logins to low privileged users...

CVE-2023-4800

Affected software: DoLogin Security WordPress plugin (before 3.7.1). Vulnerability: The widget displaying IPs of failed logins is accessible to low-privileged users, exposing potentially sensitive data. Impact (as stated): Sensitive data exposure (high confidentiality impact per the published CVS...

WordPress plugin DoLogin Security security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...