1491 matches found
CVE-2021-24224
The EFBPverifyuploadfile AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE...
Default credentials
The EFBPverifyuploadfile AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE...
CVE-2021-24224
Vulnerability summary (CVE-2021-24224) : The Easy Form Builder WordPress plugin (≤ 1.0) allows authenticated users to upload arbitrary files through the EFBP_verify_upload_file AJAX action. The upload verification lacks security checks, enabling low-privilege users to upload arbitrary files and p...
CVE-2021-24224 Easy Form Builder <= 1.0 - Authenticated Arbitrary File Upload
The EFBPverifyuploadfile AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE...
Easy Form Builder WordPress插件代码问题漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An arbitrary file upload vulnerability exists in version 1.0 of the Easy Form Builder WordPress...
CVE-2021-24224: Unrestricted Upload of File with Dangerous Type
The EFBPverifyuploadfile AJAX action of the Easy Form Builder WordPress plugin through 1.0, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE...
CVE-2021-24166: Cross-Site Request Forgery (CSRF)
The wpajaxnfoauthdisconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection...
WordPress Drag and Drop Form Builder 信息泄露漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. An information disclosure vulnerability exists in the Drag and Drop Form Builder for WordPress plugi...
WordPress插件Drag and Drop Form Builder 跨站请求伪造漏洞
WordPress is a blogging platform developed by the WordPress Wordpress Foundation using the PHP language. The platform supports PHP and MySQL servers to set up a personal blog site. related Posts is used in which a related content addition plug-in. iframe is used in which a document for another...
CVE-2021-24163: Exposure of Sensitive Information to an Unauthorized Actor
The AJAX action, wpajaxninjaformssendwpremoteinstallhandler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form...
Easy Form Builder <= 1.0 - Unauthorised AJAX calls
While confirming https://wpscan.com/vulnerability/ed0c054b-54bf-4df8-9015-c76704c93484, we noticed that all AJAX actions of the plugin, available to authenticated users, do not have any CSRF and authorisation checks in place, allowing low privilege users to call them and delete/edit arbitrary for...
Easy Form Builder <= 1.0 - Unauthorised AJAX calls
While confirming https://wpscan.com/vulnerability/ed0c054b-54bf-4df8-9015-c76704c93484, we noticed that all AJAX actions of the plugin, available to authenticated users, do not have any CSRF and authorisation checks in place, allowing low privilege users to call them and delete/edit arbitrary for...
WordPress Easy Form Builder plugin <= 1.0 - Unauthorized AJAX Calls vulnerability
Unauthorized AJAX Calls vulnerability discovered by WPScan Team in WordPress Easy Form Builder plugin versions = 1.0. Solution Plugin closed. Deactivate and delete...
Easy Form Builder <= 1.0 - Authenticated Arbitrary File Upload
The EFBPverifyuploadfile AJAX action of the plugin, available to authenticated users, does not have any security in place to verify uploaded files, allowing low privilege users to upload arbitrary files, leading to RCE. PoC The PoC will be displayed once the issue has been remediated...
WordPress Formidable Form Builder plugin <= 4.09.04 - Stored Cross-Site Scripting (XSS) vulnerability
Unauthenticated Stored Cross-Site Scripting XSS vulnerability discovered by Maximilian Barz in WordPress Formidable Form Builder plugin versions = 4.09.04. Solution Update the WordPress Formidable Form Builder plugin to the latest available version at least 4.09.05...
Contact Form - Form builder by Kali Forms < 2.1.2 - Unauthenticated Arbitrary Post Deletion
The plugin registers the kaliformsformdeleteuploadedfile AJAX action to call the "deletefile" function, and makes it accessible to all users, authenticated or not...
WordPress Contact Form builder with drag & drop plugin <= 2.1.1 - Unauthenticated Arbitrary Post Deletion vulnerability
Unauthenticated Arbitrary Post Deletion vulnerability discovered by NinTechNet in WordPress Contact Form builder with drag & drop plugin versions = 2.1.1. Solution Update the WordPress Contact Form builder with drag & drop plugin to the latest available version at least 2.1.2...
Adobe Magento Form Builder Cross-Site Scripting Vulnerability
Adobe Magento is the United States Odo than Adobe company's set of open source PHP e-commerce system . The system provides rights management , search engines and payment gateways and other features . Form Builder is used in which a form to build extensions . Adobe Magento in the Form Builder...
