CVE-2023-49742

Missing Authorization vulnerability in Support Genix.This issue affects Support Genix: from n/a through 1.2.3...

CVE-2023-49742

CVE-2023-49742 (Missing Authorization) affects the WordPress plugin/support system named Support Genix Lite, with the Red Hat advisory and CVE entry indicating a missing-authorization vulnerability in Support Genix that could affect versions up to 1.2.3. The CVE entry in NVD also notes this issue...

CVE-2023-49742 WordPress Support Genix plugin <= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerability

Missing Authorization vulnerability in Support Genix.This issue affects Support Genix: from n/a through 1.2.3...

CVE-2023-49742 WordPress Support Genix plugin <= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerability

Missing Authorization vulnerability in Support Genix.This issue affects Support Genix: from n/a through 1.2.3...

WordPress Plugin Support Genix 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

WordPress Support Genix plugin <= 1.2.3 - Broken Access Control lead to Arbitrary File Upload vulnerability

Broken Access Control lead to Arbitrary File Upload vulnerability discovered by Yudistira Arya Patchstack Alliance in WordPress Plugin Support Genix versions = 1.2.3...

WordPress Support Genix Plugin <= 1.2.3 is vulnerable to Broken Access Control

Software Support Genix Type Plugin Vulnerable versions = 1.2.3 Fixed in 1.2.4 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-49742 Patch priority High CVSS severity High 9.9 Developer Claim ownership PSID 3d8f29e82159 Credits Yudistira Arya Required...

Cross-site Scripting (XSS)

genix/cms is vulnerable to cross-site scripting. An attacker is able to inject a malicious script to "/gxadmin/index.php?page=themes=options" via the introtitle and introimage parameters, causing an execution of malicious script upon user's visit...

Cross-Site Request Forgery (CSRF)

genix/cms is vulnerable to cross-site request forgery CSRF. An improper fix to a previous vulnerability CVE-2015-2680 allows an attacker with any valid anti-CSRF tokens to perform a CSRF attack on another user and submit requests on behalf of the user...

Cross-Site Scripting (XSS)

genix/cms is vulnerable to cross-site scripting XSS attacks. The vulnerability exists because menuid parameter is not escaped properly, allowing the authenticated users to inject arbitrary code into it and launch XSS attacks...

Cross-site Scripting (XSS)

genix/cms is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the Menu ID field ininc/lib/Control/Backend/menus.control.php , allowing a malicious user to inject and execute arbitrary web script through a page=menus request...

Cross-site Scripting (XSS)

genix/cms is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the id field in /inc/lib/backend/menus.control.php, allowing a malicious user to inject and execute arbitrary web script...

Remote Code Execution (RCE)

genix/cms is vulnerable to remote code execution RCE attacks. A malicious user can upload a module zip file containing arbitrary php code that executes arbitrary commands when extracted by the application...

Remote Code Execution (RCE)

genix/cms is vulnerable to remote code execution RCE attacks. A malicious user can upload a theme zip file containing arbitrary php code that executes arbitrary commands when extracted by the application...

Cross-site Scripting (XSS)

genix/cms is vulnerable to cross-site scripting XSS attacks. The library does not properly sanitize the id field in inc/lib/Control/Backend/menus.control.php, allowing a malicious user to inject and execute arbitrary web script...

Denial Of Service (DoS)

genix/cms is vulnerable to denial of service DoS attacks. A malicious user can attempt to register with a pre-existing username by appending the...

SQL Injection Via Mailbox

genix/cms is susceptible to SQL injection attacks. The vulnerability is possible because it allows attackers to register a new user by using with a chosen ID using a request such as register.php?act=edit=1...

SQL Injection

genix/cms is vulnerable to SQL injection. The attacker can trigger the attack because menus.control.php does not filter the user input to menuid...

Arbitrary User Password Reset

genix/cms is vulnerable to arbitrary user password reset. The password reset request can be sent any number of times by anyone, leading to the unavailability of an account for real user...

AlertDanger Protection Bypass

genix/cms is vulnerable to alertDanger protection bypass. It is possible to bypass the alertDanger MSGUSEREMAILEXIST protection mechanism via a register.php?act=edit=1 request...