CVE-2024-7606

The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versions up to, and including, 3.2.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-7606

The Front End Users plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode in all versions up to, and including, 3.2.28 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for...

CVE-2024-7607

CVE-2024-7607: The Front End Users WordPress plugin is vulnerable to time-based SQL Injection via the order parameter in all versions up to 3.2.28. Exploitation requires Contributor-level access or higher; an attacker can append additional SQL to existing queries to exfiltrate data. Wordfence vul...

CVE-2024-7607 Front End Users <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection

The Front End Users plugin for WordPress is vulnerable to time-based SQL Injection via the ‘order’ parameter in all versions up to, and including, 3.2.28 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possibl...

WordPress Front End Users plugin <= 3.2.28 - Authenticated (Contributor+) Time-Based SQL Injection vulnerability

Authenticated Contributor+ Time-Based SQL Injection vulnerability discovered by Peter Thaleikis in WordPress Plugin Front End Users versions = 3.2.28...

WordPress Front End Users plugin <= 3.2.28 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Front End Users versions = 3.2.28...

WordPress plugin Front End Users 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Front End Users Plugin <= 3.2.28 is vulnerable to SQL Injection

Software Front End Users Type Plugin Vulnerable versions = 3.2.28 Fixed in 3.2.29 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-7607 Patch priority Low CVSS severity Low 8.5 Developer Claim ownership PSID 35067197eafa Credits Peter Thaleikis Required privilege Contributor...

WordPress plugin Front End Users SQL注入漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A SQL injection vulnerabili...

WordPress Front End Users Plugin <= 3.2.28 is vulnerable to Cross Site Scripting (XSS)

Software Front End Users Type Plugin Vulnerable versions = 3.2.28 Fixed in 3.2.29 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-7606 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 014dbd0a1bc8 Credits Peter Thaleikis Requir...

PT-2024-38448 · WordPress · Front End Users

Name of the Vulnerable Software and Affected Versions: Front End Users plugin for WordPress versions up to, and including, 3.2.28 Description: The issue is a time-based SQL Injection vulnerability via the order parameter. This vulnerability is due to insufficient escaping on the user-supplied...

PT-2024-38447 · WordPress · Front End Users

Name of the Vulnerable Software and Affected Versions: Front End Users plugin for WordPress versions up to, and including, 3.2.28 Description: The issue is related to Stored Cross-Site Scripting via the plugin's 'user-search' shortcode due to insufficient input sanitization and output escaping on...

GHSA-6247-7862-Q2PQ Apache Helix Front (UI) component contained a hard-coded secret

The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are...

Apache Helix Front (UI) component contained a hard-coded secret

The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that fixes this issue. Users are...

CVE-2024-22281

UNSUPPORTED WHEN ASSIGNED The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that...

CVE-2024-22281

The CVE-2024-22281 entry concerns Apache Helix Front (UI). The vulnerability is caused by a hard-coded secret in the express-session usage, enabling session spoofing via forged cookies across all versions of the Front UI. Public details state that the project is retired and no fix will be release...

CVE-2024-22281

UNSUPPORTED WHEN ASSIGNED The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that...

CVE-2024-22281 Apache Helix Front (UI): Helix front hard-coded secret in the express-session

UNSUPPORTED WHEN ASSIGNED The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that...

CVE-2024-22281 Apache Helix Front (UI): Helix front hard-coded secret in the express-session

UNSUPPORTED WHEN ASSIGNED The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects Apache Helix Front UI: all versions. As this project is retired, we do not plan to release a version that...

PT-2024-19302 · Apache · Apache Helix Front

Name of the Vulnerable Software and Affected Versions: Apache Helix Front UI versions all Description: The Apache Helix Front UI component contained a hard-coded secret, allowing an attacker to spoof sessions by generating their own fake cookies. This issue affects products that are no longer...