40 matches found
CVE-2017-1002006
Vulnerability in WordPress DTracker plugin v1.5 is caused by dtracker/save_contact.php failing to verify user authorization before inserting contacts into the wp_contact table. The issue enables unauthorized users to inject new contacts, potentially compromising site data. Connected sources corro...
CVE-2017-1002005
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contactid variable before adding it to the end of an SQL query...
CVE-2017-1002005
CVE-2017-1002005 affects the WordPress DTracker plugin (v1.5): the delete.php path uses user input for contact_id directly in an SQL query without sanitization, enabling SQL injection. Connected documents corroborate a SQL injection vulnerability in DTracker 1.5, with multiple sources flagging un...
CVE-2017-1002007
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/savemail.php doesn't check that the user is authorized before injecting new contacts into the wpcontact table...
CVE-2017-1002007
CVE-2017-1002007 affects the WordPress DTracker plugin v1.5. The issue is in dtracker/save_mail.php, which does not verify that the user is authorized before inserting new contacts into wp_contact. The root cause is missing authorization checks, allowing an unauthenticated attempt to inject data ...
CVE-2017-1002006
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/savecontact.php doesn't check that the user is authorized before injecting new contacts into the wpcontact table...
CVE-2017-1002007: Missing Authorization
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/savemail.php doesn't check that the user is authorized before injecting new contacts into the wpcontact table...
CVE-2017-1002006: Missing Authorization
Vulnerability in wordpress plugin DTracker v1.5, The code dtracker/savecontact.php doesn't check that the user is authorized before injecting new contacts into the wpcontact table...
CVE-2017-1002004: Improper Neutralization of Special Elements used in an SQL Command
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/download.php user input isn't sanitized via the id variable before adding it to the end of an SQL query...
PT-2017-10993
Name of the Vulnerable Software and Affected Versions DTracker version 1.5 Description The issue concerns a lack of input sanitization in the DTracker plugin for WordPress. Specifically, in the file ./dtracker/download.php, user input via the id variable is not properly sanitized before being add...
PT-2017-10995
Name of the Vulnerable Software and Affected Versions DTracker version 1.5 Description The issue concerns a lack of authorization check in the DTracker plugin for WordPress. Specifically, the code in dtracker/save contact.php does not verify user authorization before adding new contacts to the wp...
PT-2017-10996
Name of the Vulnerable Software and Affected Versions DTracker version 1.5 Description The issue concerns a lack of authorization check in the code, specifically in the dtracker/save mail.php file, which allows unauthorized injection of new contacts into the wp contact table. Recommendations For...
PT-2017-10994
Name of the Vulnerable Software and Affected Versions DTracker version 1.5 Description The issue concerns a lack of input sanitization in the DTracker plugin. Specifically, user input via the contact id variable is not properly sanitized before being added to an SQL query in the...
CVE-2017-1002005: Improper Neutralization of Special Elements used in an SQL Command
Vulnerability in wordpress plugin DTracker v1.5, In file ./dtracker/delete.php user input isn't sanitized via the contactid variable before adding it to the end of an SQL query...
WordPress DTracker plugin content injection vulnerability
WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A content injection vulnerability exists in the WordPress DTracker plugin, which stems from the program failing ...
WordPress DTracker plugin content injection vulnerability (CNVD-2017-03798)
WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A content injection vulnerability exists in the WordPress DTracker plugin, which stems from the program failing ...
Dtracker <= 1.5 - Unauthorised Contract Creation
Plugin is still affected and has been closed...
WordPress plugin DTracker SQL injection vulnerability (CNVD-2017-03688)
WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language, which supports the setting up of personal blog sites on servers with PHP and MySQL.DTracker is one of the plugins used to track site downloads. A SQL injection vulnerability exists in...
WordPress Plugin DTracker SQL Injection Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platforms developed using the PHP language, which supports personal blog sites on servers running PHP and MySQL.DTracker is one of the plug-ins used to track site downloads. A SQL injection vulnerability exists in WordPress plugin...