Design/Logic Flaw

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiuserid for invoice retrieval...

Privilege escalation

The wp-invoice plugin before 4.1.1 for WordPress has wpiupdateuseroption privilege escalation...

Improper access control

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...

Design/Logic Flaw

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...

Design/Logic Flaw

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpitwocheckout payer metadata updates...

CVE-2016-11011

The CVE-2016-11011 entry concerns the WordPress plugin WP-Invoice prior to version 4.1.1, which is affected by a privilege-escalation vulnerability in the wpi_update_user_option component. The issue enables elevated privileges within the plugin, as described across multiple sources (NVD entry ref...

CVE-2016-11011

The wp-invoice plugin before 4.1.1 for WordPress has wpiupdateuseroption privilege escalation...

CVE-2016-11010

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpitwocheckout payer metadata updates...

CVE-2016-11010

The CVE-2016-11010 entry concerns the WordPress WP-Invoice plugin, affected in versions before 4.1.1. The root cause is incorrect access control over wpi_twocheckout payer metadata updates, enabling potential unauthorized updates to payer data. Public documentation in the provided sources confirm...

CVE-2016-11009

The CVE-2016-11009 entry affects the WordPress plugin WP-Invoice prior to version 4.1.1 . The vulnerability is caused by incorrect access control over wpi_interkassa payer metadata updates . The impact is described as an access control issue; no exploitation details are provided in the given docu...

CVE-2016-11009

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiinterkassa payer metadata updates...

CVE-2016-11008

The CVE-2016-11008 entry concerns the WordPress plugin WP-Invoice prior to 4.1.1, where there is incorrect access control over wpi_paypal payer metadata updates. The issue is described as an access-control flaw in the handling of PayPal payer metadata, affecting releases before 4.1.1. Public tech...

CVE-2016-11008

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpipaypal payer metadata updates...

CVE-2016-11007

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpiuserid for invoice retrieval...

CVE-2016-11006

The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admininit settings changes...

CVE-2016-11006

CVE-2016-11006 affects the WP-Invoice WordPress plugin prior to version 4.1.1. The root issue is incorrect access control for admin_init settings changes, enabling potential unauthorized modification of settings. Public details list this as a privilege/permission-related flaw with a medium-severi...

Hackers Can Manipulate Media Files You Receive Via WhatsApp and Telegram

If you think that the media files you receive on your end-to-end encrypted secure messaging apps can not be tampered with, you need to think again. Security researchers at Symantec yesterday demonstrated multiple interesting attack scenarios against WhatsApp and Telegram Android apps, which could...

CVE-2019-9085

Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service invoice-creation outage via the nfile parameter to visualizzacontratto.php with invalid arguments any non-numeric value, as demonstrated by the anno=2019&idtransazione=1&numerocontratto=1&nfile=a query string ...

Design/Logic Flaw

Hoteldruid before v2.3.1 allows remote authenticated users to cause a denial of service invoice-creation outage via the nfile parameter to visualizzacontratto.php with invalid arguments any non-numeric value, as demonstrated by the anno=2019&idtransazione=1&numerocontratto=1&nfile=a query string ...

Sales ERP 8.1 - Multiple SQL Injection

Sales ERP 8.1 - Multiple SQL Injection =========================================================================================== Exploit Title: SalesERP v.8.1 SQL Inj. Dork: N/A Date: 13-05-2019 Exploit Author: Mehmet EMIROGLU Vendor Homepage:...