191 matches found
WordPress Front End Users - Reflected XSS
WordPress Front End Users plugin = 3.2.32 contains a reflected cross-site scripting caused by lack of sanitization and escaping of a parameter before outputting it in the page, letting attackers execute malicious scripts in the context of high privilege users, exploit requires attacker to craft a...
CVE-2025-2005
WordPress FEUP Arbitrary File Upload Exploit CVE-2025-2005 This repository provides a Proof of Concept PoC exploit for the WordPress Front End Users plugin versions up to 3.2.32, which is vulnerable to arbitrary file upload due to missing MIME/file-type validation in its registration form.This...
CVE-2025-2005
CVE-2025-2005 WordPress Front End Users Plugin = 3.2.32 is vulnerable to Arbitrary File Upload WordPress Front-End Users Plugin Exploit Vulnerability Information Plugin Name : Front-End Users Plugin Version Affected : = 3.2.32 Vulnerability Type : Arbitrary File Upload CVSS Score : 10 Critical Ri...
CVE-2025-2005
CVE-2025-2005 — Front-End Users Arbitrary File Upload CVE-2025-2005 WordPress Front-End Users — Unauthenticated Arbitrary File Upload 0xZ3R0 // h4ckxel 0x00 — Executive Summary Front-End Users is affected by an unauthenticated arbitrary file upload vulnerability affecting versions ≤ 3.2.32. The...
CVE-2026-22646
Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information like file paths, database errors, or software versions that can be used to map the application's internal structu...
CVE-2026-22646
Certain error messages returned by the application expose internal system details that should not be visible to end users, providing attackers with valuable reconnaissance information like file paths, database errors, or software versions that can be used to map the application's internal structu...
CVE-2025-65960: Insufficient Type Distinction
Contao is an Open Source CMS. From version 4.0.0 to before 4.13.57, before 5.3.42, and before 5.6.5, back end users with precise control over the contents of template closures can execute arbitrary PHP functions that do not have required parameters. This issue has been patched in versions 4.13.57...
PT-2025-48077
Name of the Vulnerable Software and Affected Versions Contao versions 4.0.0 through 4.13.56 Contao versions 5.3.0 through 5.3.41 Contao versions 5.6.0 through 5.6.4 Description Backend users with control over template closures can execute arbitrary PHP functions without required parameters. The...
CVE-2025-62072
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through = 3.2.33...
EUVD-2025-35366
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through = 3.2.33...
CVE-2025-62072
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through = 3.2.33...
CVE-2025-62072 WordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerability
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through = 3.2.33...
CVE-2025-62072
CVE-2025-62072 is a missing/broken authorization vulnerability in the WordPress plugin Front End Users (WordPress Front End Users plugin) , affecting versions up to and including 3.2.33. The issue permits access control bypass (Broken Access Control) with no user interaction, as indicated by CVSS...
CVE-2025-62072 WordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerability
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through = 3.2.33...
WordPress plugin Front End Users 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
CVE-2025-62072: Missing Authorization
Missing Authorization vulnerability in Rustaurius Front End Users front-end-only-users.This issue affects Front End Users: from n/a through = 3.2.33...
WordPress Front End Users plugin <= 3.2.33 - Broken Access Control vulnerability
Broken Access Control vulnerability discovered by Legion Hunter in WordPress Plugin Front End Users versions = 3.2.33...
PT-2025-43362
Name of the Vulnerable Software and Affected Versions Rustaurius Front End Users versions through 3.2.33 Description A missing authorization issue exists in Rustaurius Front End Users. The issue is present in the front-end-only-users component. Recommendations Update to a version later than 3.2.3...