7902 matches found
CVE-2021-34661 WP Fusion Lite <= 3.37.18 Cross-Site Request Forgery to Data Deletion
The WP Fusion Lite WordPress plugin is vulnerable to Cross-Site Request Forgery via the showlogssection function found in the /includes/admin/logging/class-log-handler.php file which allows attackers to drop all logs for the plugin, in versions up to and including 3.37.18...
CVE-2021-34661
The CVE-2021-34661 entry describes a Cross-Site Request Forgery (CSRF) vulnerability in the WP Fusion Lite WordPress plugin, affecting the show_logs_section function in ~/includes/admin/logging/class-log-handler.php. It allows an attacker to drop all plugin logs for versions up to and including 3...
CVE-2021-24521
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack...
CVE-2021-24521
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack...
Sql injection
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack...
CVE-2021-24521
The CVE-2021-24521 entry concerns the WordPress plugin Side Menu Lite (before version 2.2.1). Connected sources confirm an authenticated SQL injection vulnerability due to improper input sanitization when constructing SQL statements. Impact is limited to privileged users (administrator or those m...
CVE-2021-24521 Side Menu Lite < 2.2.1 - Authenticated SQL Injection
The Side Menu Lite – add sticky fixed buttons WordPress plugin before 2.2.1 does not properly sanitize input values from the browser when building an SQL statement. Users with the administrator role or permission to manage this plugin could perform an SQL Injection attack...
WordPress 跨站请求伪造漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability in the WordPress plugin WP Fusion Lite allows an attacker to delete all the...
WP Fusion Lite < 3.37.31 - Reflected Cross-Site Scripting (XSS)
The plugin does not escape the startdate and enddate parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting issue. This is due to an incorrect fix of CVE-2021-34660 https://wpscan.com/vulnerability/4a4934d6-282d-4e8c-922a-6b1f12884191...
WP Fusion Lite < 3.37.31 - Reflected Cross-Site Scripting (XSS)
The plugin does not escape the startdate and enddate parameters before outputting them back in an admin page, leading to a Reflected Cross-Site Scripting issue. This is due to an incorrect fix of CVE-2021-34660 https://wpscan.com/vulnerability/4a4934d6-282d-4e8c-922a-6b1f12884191 PoC...
WordPress 跨站脚本漏洞
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Wordpress Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A security vulnerability in the WordPress plugin WP Fusion Lite allows attackers to inject arbitrary...
WordPress SQL注入漏洞
WordPress is a set of blogging platforms developed by the WordPress Wordpress Foundation using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress Side Menu Lite â add sticky fixed buttonsâ is vulnerable to a SQL injection vulnerability...
WordPress Ad Blocker Notify Lite plugin <= 2.4.0 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by iohex and WPScanTeam in WordPress Ad Blocker Notify Lite plugin versions = 2.4.0. Solution 2021-08-25 - no patched version is available. Deactivate and delete...
DEBIAN-CVE-2021-38205
drivers/net/ethernet/xilinx/xilinxemaclite.c in the Linux kernel before 5.13.3 makes it easier for attackers to defeat an ASLR protection mechanism because it prints a kernel pointer i.e., the real IOMEM pointer...
WordPress WP Fusion Lite plugin <= 3.37.18 - Cross-Site Request Forgery (CSRF) vulnerability leading to Data Deletion
Cross-Site Request Forgery CSRF vulnerability leading to Data Deletion discovered by Xu-Liang Liao in WordPress WP Fusion Lite plugin versions = 3.37.18. Solution This plugin has been closed as of August 6, 2021 and is not available for download. This closure is temporary, pending a full review...
WP Fusion Lite < 3.37.30 - Reflected Cross-Site Scripting (XSS)
The plugin is vulnerable to Reflected Cross-Site Scripting via the startdate parameter found in the /includes/admin/logging/class-log-table-list.php file which allows attackers to inject arbitrary web scripts WPScanTeam: The issue was reported as fixed, but the fix was insufficient and a separate...
WordPress WP Fusion Lite plugin <= 3.37.18 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Xu-Liang Liao in WordPress WP Fusion Lite plugin versions = 3.37.18. Solution This plugin has been closed as of August 6, 2021 and is not available for download. This closure is temporary, pending a full review...
Ecobee Ecobee3 Lite Hardcoded Default Root Credentials Vulnerability
Ecobee Ecobee3 Lite is a Wi-Fi smart thermostat from Ecobee Canada.Ecobee Ecobee3 Lite contains a security vulnerability that could be exploited by an attacker to access the password-protected bootloader environment via the serial console...
Ecobee Ecobee3 Lite null pointer dereference vulnerability
Ecobee Ecobee3 Lite is a Wi-Fi smart thermostat from Ecobee Canada.A security vulnerability exists in Ecobee Ecobee3 Lite, which stems from a reference to a freed pointer condition in the product's WIFI access settings. An attacker could cause a denial of service to the target via an ad hoc HTTP...