294 matches found
CVE-2024-10002 Rover IDX <= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator
The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation and capability check on the 'roveridxrefreshsocialcallback' function. This makes it possible for authenticated attackers, with...
CVE-2024-10002
CVE-2024-10002 — Rover IDX WordPress plugin : Authentication bypass in versions up to and including 3.0.0.2905 due to insufficient validation in rover_idx_refresh_social_callback, allowing authenticated users with subscriber-level permissions and above to log in as an administrator. Wordfence rep...
CVE-2024-10002 Rover IDX <= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator
The Rover IDX plugin for WordPress is vulnerable to Authentication Bypass in versions up to, and including, 3.0.0.2905. This is due to insufficient validation and capability check on the 'roveridxrefreshsocialcallback' function. This makes it possible for authenticated attackers, with...
PT-2024-15968 · WordPress · Rover Idx Plugin
Name of the Vulnerable Software and Affected Versions: Rover IDX plugin for WordPress versions up to, and including, 3.0.0.2903 Description: The issue allows unauthorized access, modification, and loss of data due to a missing capability check on multiple functions. This makes it possible for...
WordPress plugin Rover IDX 安全漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a set of blogging platforms developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security...
WordPress Rover IDX plugin <= 3.0.0.2905 - Authenticated (Subscriber+) Authentication Bypass to Administrator vulnerability
Authenticated Subscriber+ Authentication Bypass to Administrator vulnerability discovered by István Márton in WordPress Plugin Rover IDX versions = 3.0.0.2905...
WordPress Rover IDX plugin <= 3.0.0.2903 - Authenticated (Subscriber+) Missing Authorization via Multiple Functions vulnerability
Authenticated Subscriber+ Missing Authorization via Multiple Functions vulnerability discovered by István Márton in WordPress Plugin Rover IDX versions = 3.0.0.2903...
WordPress Rover IDX Plugin <= 3.0.0.2905 is vulnerable to Privilege Escalation
Software Rover IDX Type Plugin Vulnerable versions = 3.0.0.2905 Fixed in 3.0.0.2906 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2024-10002 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 08b7032800d8 Credits...
PT-2024-15967 · WordPress · Rover Idx Plugin
Name of the Vulnerable Software and Affected Versions: Rover IDX plugin for WordPress versions up to and including 3.0.0.2905 Description: The issue arises from insufficient validation and capability check on the rover idx refresh social callback function, allowing authenticated attackers with...
WordPress Rover IDX Plugin <= 3.0.0.2903 is vulnerable to Broken Access Control
Software Rover IDX Type Plugin Vulnerable versions = 3.0.0.2903 Fixed in 3.0.0.2905 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2024-10003 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 2b090aab193c Credits István Márton Required...
CVE-2024-8719
The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters like 'MaxBeds' and 'MinBeds' in all versions up to, and including, 3.14.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2024-8719
CVE-2024-8719 – Flexmls® IDX Plugin for WordPress has a Reflected Cross-Site Scripting vulnerability in all versions up to 3.14.22. The issue arises from insufficient input sanitization and output escaping for multiple parameters (e.g., MaxBeds, MinBeds), allowing an unauthenticated attacker to i...
CVE-2024-8719 Flexmls® IDX Plugin <= 3.14.22 - Reflected Cross-Site Scripting
The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters like 'MaxBeds' and 'MinBeds' in all versions up to, and including, 3.14.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
CVE-2024-8719 Flexmls® IDX Plugin <= 3.14.22 - Reflected Cross-Site Scripting
The Flexmls® IDX Plugin plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via several parameters like 'MaxBeds' and 'MinBeds' in all versions up to, and including, 3.14.22 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated...
WordPress plugin Flexmls® IDX Plugin 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...
WordPress Flexmls® IDX Plugin <= 3.14.22 is vulnerable to Cross Site Scripting (XSS)
Software Flexmls® IDX Type Plugin Vulnerable versions = 3.14.22 Fixed in 3.14.23 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2024-8719 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 8b694097c0b5 Credits kayge Required...
CVE-2024-44047
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in IDX Broker IMPress for IDX Broker allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.2.2...
CVE-2024-44047
Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in IDX Broker IMPress for IDX Broker idx-broker-platinum allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through = 3.2.2...
CVE-2024-44047 WordPress IMPress for IDX Broker plugin <= 3.2.2 - Cross Site Scripting (XSS) vulnerability
Improper Neutralization of Input During Web Page Generation XSS or 'Cross-site Scripting' vulnerability in IDX Broker IMPress for IDX Broker allows Stored XSS.This issue affects IMPress for IDX Broker: from n/a through 3.2.2...