CVE-2019-15114

CVE-2019-15114 affects the WordPress FormCraft Form Builder plugin. The vulnerability is a CSRF flaw in versions before 1.2.2, arising from insufficient request verification, potentially allowing unauthorized actions on behalf of a user. Mitigation: upgrade to 1.2.2 or later (as indicated by mult...

CVE-2019-15114: Cross-Site Request Forgery (CSRF)

The formcraft-form-builder plugin before 1.2.2 for WordPress has CSRF...

Formidable < 4.02.01 - Unsafe Deserialisation

The Formidable Form Builder – Contact Form, Survey & Quiz Forms Plugin for WordPress WordPress plugin was affected by an Unsafe Deserialisation security vulnerability...

WordPress Formidable Form Builder plugin <= 4.02 - Unsafe Deserialisation vulnerability

Unsafe Deserialisation vulnerability discovered in WordPress Formidable Form Builder plugin versions = 4.02. Solution Update the WordPress Formidable Form Builder plugin to the latest available version at least 4.02.01...

WordPress Contact Form Builder Plugin < 1.0.69 CSRF Vulnerability

The WordPress plugin Copyright C 2019 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...

CVE-2019-11557

The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the...

CVE-2019-11557

The CVE-2019-11557 entry concerns the WordPress plugin WebDorado Contact Form Builder, versions prior to 1.0.69. The vulnerability is a CSRF flaw on wp-admin/admin-ajax.php where discrepancies between POST[action] and GET[action] (unsanitized GET value) enable local file inclusion via directory t...

CVE-2019-11557

The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the...

CVE-2019-11557: Improper Limitation of a Pathname to a Restricted Directory

The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the...

WordPress Contact Form Builder plugin <= 1.0.68 - Cross-Site Request Forgery (CSRF) leading to Local File Inclusion (LFI) vulnerability

Cross-Site Request Forgery CSRF leading to Local File Inclusion LFI vulnerability found by Panagiotis Vagenas in WordPress Contact Form Builder plugin versions = 1.0.68. Solution Update the WordPress Contact Form Builder plugin to the latest available version at least 1.0.69...

Contact Form Builder <= 1.0.68 - CSRF to LFI

The WDContactFormBuilder WordPress plugin was affected by a CSRF to LFI security vulnerability...

WordPress Plugin Contact Form Builder 1.0.67 - Cross-Site Request Forgery Local File Inclusion

WordPress Plugin Contact Form Builder 1.0.67 - Cross-Site Request Forgery Local File Inclusion Exploit Title: Contact Form Builder CSRF → LFI Date: 2019-03-17 Exploit Author: Panagiotis Vagenas Vendor Homepage: http://web-dorado.com/ Software Link: https://wordpress.org/plugins/contact-form-build...

WordPress Plugin Contact Form Builder 1.0.67 - Cross-Site Request Forgery / Local File Inclusion

Exploit Title: Contact Form Builder CSRF → LFI Date: 2019-03-17 Exploit Author: Panagiotis Vagenas Vendor Homepage: http://web-dorado.com/ Software Link: https://wordpress.org/plugins/contact-form-builder Version: 1.0.67 Tested on: WordPress 5.1.1 Description ----------- Plugin implements the...

WordPress Contact Form Builder 1.0.67 Plugin - CSRF / Local File Inclusion Exploit

Exploit for php platform in category web applications Exploit Title: Contact Form Builder CSRF → LFI Date: 2019-03-17 Exploit Author: Panagiotis Vagenas Vendor Homepage: http://web-dorado.com/ Software Link: https://wordpress.org/plugins/contact-form-builder Version: 1.0.67 Tested on: WordPress...

WordPress Plugin Ultimate Form Builder Database Leakage Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the database of WordPress plugin Ultimate Form Builder. An attacker can exploit the...

WordPress Ultimate Form Builder 1.0 Database Disclosure

Exploit Title : WordPress Ultimate Form Builder Plugins 1.0 Database Disclosure Author Discovered By : KingSkrupellos Team : Cyberizm Digital Security Army Date : 28/03/2019 Vendor Homepage : access-keys.com Software Information Link : codecanyon.net/item/ultimate-form-builder/14644208...

Unspecified Vulnerability in Oracle PeopleSoft Products (CNVD-2019-29280)

Oracle PeopleSoft Products is a set of enterprise human capital management solutions from Oracle, which provides human capital management, financial management, supplier relationship management, etc. PeopleSoft Enterprise CC Common Application Objects are One of the Common Application Objects...

Joomla Codextrous B2jcontact 2.1.17 Shell Upload

Exploit Title : Joomla Codextrous ComB2jcontact Components 2.1.17 Shell Upload Author Discovered By : KingSkrupellos from Cyberizm Digital Security Army Date : 04/01/2019 Vendor Homepage : codextrous.com/joomla-components/b2j-contact.html + extensions.joomla.org/extension/b2j-contact/ Software...

WordPress Ultimate Form Builder Lite Plugin SQL Injection

An SQL injection vulnerability exists in WordPress Ultimate Form Builder Lite Plugin. Successful exploitation of this vulnerability would allow a remote attacker to execute arbitrary SQL commands on the affected system...

WordPress Ultimate Form Builder Lite plugin <= 1.3.7 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability found by Neven Biruski in WordPress Ultimate Form Builder Lite plugin versions = 1.3.7. Solution Update the WordPress Ultimate Form Builder Lite plugin to the latest available version at least 1.3.8...