79 matches found
JIZHICMS SQL注入漏洞
JIZHICMS is an open-source content management system developed by JIZHI Corporation in China. Versions of jizhiCMS 2.5.6 and earlier had a SQL injection vulnerability. This vulnerability stemmed from incorrect handling of the parameter ‘data’ in the function ‘findAll’ of the ‘Model.php’ library i...
CVE-2025-14012
A vulnerability was determined in JIZHICMS up to 2.5.5. The affected element is the function deleteAll/findAll/delete of the file /index.php/admins/Comment/deleteAll.html of the component Batch Delete Comments. Executing a manipulation can lead to sql injection. The attack can be launched remotel...
WordPress FindAll Listing plugin <= 1.0.5 - Unauthenticated Privilege Escalation vulnerability
Unauthenticated Privilege Escalation vulnerability discovered by シルAsuna in WordPress Plugin FindAll Listing versions = 1.0.5...
CVE-2025-13538
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findalllistinguserregistrationadditionalparams' function not restricting what user roles a user can register with. This makes it possible for...
WordPress FindAll Membership plugin <= 1.0.4 - Authentication Bypass via Social Login vulnerability
Authentication Bypass via Social Login vulnerability discovered by István Márton - Wordfence in WordPress Plugin FindAll Membership versions = 1.0.4...
EUVD-2025-199796
The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findallmembershipcheckfacebookuser' and the...
EUVD-2025-199802
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findalllistinguserregistrationadditionalparams' function not restricting what user roles a user can register with. This makes it possible for...
CVE-2025-13539
The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findallmembershipcheckfacebookuser' and the...
CVE-2025-13538
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findalllistinguserregistrationadditionalparams' function not restricting what user roles a user can register with. This makes it possible for...
CVE-2025-13539 FindAll Membership <= 1.0.4 - Authentication Bypass via Social Login
The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findallmembershipcheckfacebookuser' and the...
CVE-2025-13539
CVE-2025-13539 affects the WordPress plugin FindAll Membership (≤ 1.0.4). Root cause: authentication bypass due to improper login handling tied to social login verifications, enabling unauthenticated attackers (with an existing site account) to log in as an administrator. According to Wordfence, ...
CVE-2025-13539 FindAll Membership <= 1.0.4 - Authentication Bypass via Social Login
The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findallmembershipcheckfacebookuser' and the...
CVE-2025-13538 FindAll Listing <= 1.0.5 - Unauthenticated Privilege Escalation
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findalllistinguserregistrationadditionalparams' function not restricting what user roles a user can register with. This makes it possible for...
CVE-2025-13538
CVE-2025-13538 affects the WordPress plugin FindAll Listing (<= 1.0.5). The issue is an unrestricted registration parameter check in the plugin’s registration flow, allowing unauthenticated users to set the administrator role during registration. Exploitation requires that the FindAll Membersh...
CVE-2025-13538 FindAll Listing <= 1.0.5 - Unauthenticated Privilege Escalation
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findalllistinguserregistrationadditionalparams' function not restricting what user roles a user can register with. This makes it possible for...
PT-2025-48227
Name of the Vulnerable Software and Affected Versions FindAll Listing versions prior to 1.0.6 Description The FindAll Listing plugin for WordPress is susceptible to a privilege escalation issue. This occurs because the findall listing user registration additional params function does not properly...
PT-2025-48228
Name of the Vulnerable Software and Affected Versions FindAll Membership plugin for WordPress versions up to and including 1.0.4 Description The FindAll Membership plugin for WordPress is susceptible to an Authentication Bypass issue. The plugin does not properly log in a user after verifying dat...
CVE-2025-13538: Improper Privilege Management
The FindAll Listing plugin for WordPress is vulnerable to Privilege Escalation in all versions up to, and including, 1.0.5. This is due to the 'findalllistinguserregistrationadditionalparams' function not restricting what user roles a user can register with. This makes it possible for...
WordPress plugin FindAll Listing 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform has the ability to host personal blog sites on PHP and MySQL based servers.WordPress plugin is an application plugin. A security vulnerabili...
CVE-2025-13539: Authentication Bypass Using an Alternate Path or Channel
The FindAll Membership plugin for WordPress is vulnerable to Authentication Bypass in all versions up to, and including, 1.0.4. This is due to the plugin not properly logging in a user with the data that was previously verified through the 'findallmembershipcheckfacebookuser' and the...