146 matches found
Geo Mashup <= 1.13.18 - SQL Injection
Geo Mashup WordPress plugin = 1.13.18 is vulnerable to time-based SQL injection via the sort parameter. The issue exists because the sort value is insufficiently sanitized in render-map.php/template tag code paths. id: CVE-2026-4060 info: name: Geo Mashup = 1.13.18 - SQL Injection author:...
Geo Mashup <= 1.13.17 - SQL Injection
Geo Mashup WordPress plugin = 1.13.17 contains a SQL injection caused by insufficient escaping of the 'sort' parameter, letting unauthenticated attackers extract sensitive database information remotely. id: CVE-2026-2416 info: name: Geo Mashup = 1.13.17 - SQL Injection author: Shivam Kamboj...
CVE-2026-4060-PoC
CVE-2026-4060 — Geo Mashup ≤ 1.13.18 未认证SQL注入PoC -blue 未认证 攻击者可以通过Geo Mashup render-map 端点的 sort 参数向 ORDER BY 子句注入任意SQL，实现基于时间的盲注，提取敏感数据库信息。 目录 漏洞概述 测试环境 如何运行 测试结果 修复建议 检测方法 时间线 参考资料 漏洞概述 技术细节 render-map 端点接收的 sort 参数未经任何净化直接传入 $wpdb-getresults 调用： root@kitploit: // render-map.php 简化 $sort =...
CVE-2026-66449
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...
CVE-2026-66450
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
EUVD-2026-57872
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
CVE-2026-66450 WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
CVE-2026-66450
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
CVE-2026-66449
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...
EUVD-2026-57871
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...
CVE-2026-66449
CVE-2026-66449 : Unauthenticated XSS in WordPress Geo Mashup plugin, affected versions
CVE-2026-66450
CVE-2026-66450 refers to an Unauthenticated Local File Inclusion in the WordPress plugin Geo Mashup, affected versions
CVE-2026-66449 WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability
Unauthenticated Cross Site Scripting XSS in Geo Mashup = 1.13.18 versions...
PT-2026-71559
Unauthenticated Local File Inclusion in Geo Mashup = 1.13.18 versions...
WordPress Geo Mashup plugin <= 1.13.18 - Local File Inclusion vulnerability
Local File Inclusion vulnerability discovered by daroo in WordPress Plugin Geo Mashup versions = 1.13.18...
WordPress Geo Mashup plugin <= 1.13.18 - Cross Site Scripting (XSS) vulnerability
Cross Site Scripting XSS vulnerability discovered by daroo in WordPress Plugin Geo Mashup versions = 1.13.18...
EUVD-2026-37612
Subscriber SQL Injection in Geo Mashup = 1.13.19 versions...
CVE-2026-48967
Subscriber SQL Injection in Geo Mashup = 1.13.19 versions...