195 matches found
JetEngine < 3.2.5 - Authenticated (Contributor+) Privilege Escalation
Description The JetEngine plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 3.2.4. This is due to an unknown issue. This makes it possible for authenticated attackers, with contributor-level access and above, to gain elevated privileges...
JetEngine < 3.2.5 - Missing Authorization
Description The JetEngine plugin for WordPress is vulnerable to unauthorized access due to a missing capability check in versions up to, and including, 3.2.4. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action...
WordPress JetEngine Plugin <= 3.2.5.1 is vulnerable to Cross Site Request Forgery (CSRF)
Software JetEngine Type Plugin Vulnerable versions = 3.2.5.1 Fixed in 3.2.5.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-48762 Patch priority Low CVSS severity Low 6.3 Developer Crocoblock PSID 289af3150189 Credits Rafie Muhammad Patchstack...
WordPress JetEngine Plugin <= 3.2.5.1 is vulnerable to Broken Access Control
Software JetEngine Type Plugin Vulnerable versions = 3.2.5.1 Fixed in 3.2.5.2 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-48761 Patch priority Medium CVSS severity Medium 6.3 Developer Crocoblock PSID 12b2e0c6af30 Credits Rafie Muhammad Patchstack...
WordPress JetEngine Plugin <= 3.2.4 is vulnerable to Broken Access Control
Software JetEngine Type Plugin Vulnerable versions = 3.2.4 Fixed in 3.2.5 OWASP Top 10 A1: Broken Access Control Classification Broken Access Control CVE CVE-2023-48758 Patch priority High CVSS severity High 7.1 Developer Crocoblock PSID 14b80894884d Credits Rafie Muhammad Patchstack Required...
WordPress JetEngine Plugin <= 3.2.4 is vulnerable to Privilege Escalation
Software JetEngine Type Plugin Vulnerable versions = 3.2.4 Fixed in 3.2.5 OWASP Top 10 A7: Identification and Authentication Failures Classification Privilege Escalation CVE CVE-2023-48757 Patch priority Medium CVSS severity Medium 8.8 Developer Crocoblock PSID 629276ed62fc Credits Rafie Muhammad...
WordPress JetEngine Plugin < 3.1.3.1 is vulnerable to Remote Code Execution (RCE)
Software JetEngine Type Plugin Vulnerable versions 3.1.3.1 Fixed in 3.1.3.1 OWASP Top 10 A1: Injection Classification Remote Code Execution RCE CVE CVE-2023-1406 Patch priority High CVSS severity High 9.1 Developer Crocoblock PSID a91fe4278b33 Credits R3zk0n Required privilege Author Published 11...
CVE-2023-1406
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability...
CVE-2023-1406
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability...
Remote code execution
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability...
CVE-2023-1406 JetEngine < 3.1.3.1 - Author+ Remote Code Execution
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability...
CVE-2023-1406
CVE-2023-1406 affects the JetEngine WordPress plugin prior to 3.1.3.1. The vulnerability arises from uploading files without sufficient checks to prevent executable content, enabling remote code execution. A fix is available: upgrade to JetEngine 3.1.3.1 or later. If upgrading is not possible, ap...
CVE-2023-1406 JetEngine < 3.1.3.1 - Author+ Remote Code Execution
The JetEngine WordPress plugin before 3.1.3.1 includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability...
WordPress plugin JetEngine 代码问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A code issue vulnerability...
PT-2023-16962 · WordPress · Jetengine
Name of the Vulnerable Software and Affected Versions: JetEngine WordPress plugin versions prior to 3.1.3.1 Description: The issue allows for remote code execution due to the plugin's failure to properly verify that uploaded files are not executable. Recommendations: For versions prior to 3.1.3.1...
JetEngine < 3.1.3.1 - Author+ Remote Code Execution
The plugin includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability. fetch"/wp-admin/admin.php?action=jetengineformsimport", "headers": "accept": "text/html", "content-type": "multipart/form-data;...
JetEngine < 3.1.3.1 - Author+ Remote Code Execution
The plugin includes uploaded files without adequately ensuring that they are not executable, leading to a remote code execution vulnerability. PoC fetch"/wp-admin/admin.php?action=jetengineformsimport", "headers": "accept": "text/html", "content-type": "multipart/form-data;...
crocoblock JetEngine Cross-Site Scripting Vulnerability (CNVD-2022-05012)
crocoblock JetEngine is a dynamic content plugin that allows you to build complex websites quickly and cost-effectively. crocoblock JetEngine prior to version 2.9.1 is vulnerable to a cross-site scripting vulnerability that stems from a lack of data validation filtering of user-supplied data and...
crocoblock JetEngine code issue vulnerability
crocoblock JetEngine is a dynamic content plugin that allows you to build complex websites quickly and cost-effectively. crocoblock JetEngine versions prior to 2.9.1 are vulnerable to a code issue that stems from the application's inability to properly validate and clean up form data. An attacker...
CVE-2021-41844
Crocoblock JetEngine before 2.9.1 does not properly validate and sanitize form data...