CVE-2025-49029

🚨 WordPress Custom Login And Signup Widget プラグイン 🔥 基本スコア: 9.1 CRITICAL CWE ID: CWE-94 – コード生成の制御不備（コードインジェクション） 🧠 説明 このプラグインでは、管理者が設定ページの 送信者名（Sender’s Name） フィールドを介して sn.php の内容を変更できます。 ユーザーから提供された入力は、サニタイズや検証が行われずに直接 PHP ファイルに書き込まれます 。 その結果、text パラメータに指定された任意の PHP コードが PHP...

CVE-2024-5324

CVE-2024-5324 Login/Signup Popup Inline Form + Woocommerce 2.7.1 - 2.7.2 - 인증 누락으로 인한 임의 옵션 업데이트 취약점 설명: WordPress용 Login/Signup Popup Inline Form + Woocommerce 플러그인은 2.7.12.7.2 버전에서 'importsettings' 함수에 대한 권한 확인이 누락되어 데이터의 무단 수정에 취약합니다. 이로 인해 구독자 수준 이상의 인증된 공격자가 영향을 받는 사이트에서 임의의 옵션을 변경할 수 있습니다. ...

WordPress Login & Register Forms plugin < 4.0.2 - Unauthenticated Account Takeover via Password Reset Code Brute Force vulnerability

Unauthenticated Account Takeover via Password Reset Code Brute Force vulnerability discovered by ryan fabella in WordPress Plugin Login/Signup Popup versions 4.0.2...

WordPress Login & Register Forms plugin < 4.0.2 - Unauthenticated Registered User Email Address Disclosure via Lost Password Response vulnerability

Unauthenticated Registered User Email Address Disclosure via Lost Password Response vulnerability discovered by Artus KG in WordPress Plugin Login/Signup Popup versions 4.0.2...

CVE-2026-14836

The Login & Register Forms WordPress plugin (versions before 3.2.5 ) contains an unauthenticated account takeover vulnerability due to an improper rate limit enforcement. The plugin incorrectly keys the password-reset verification-code and the per-source attempt counter on an unauthenticated, cli...

CVE-2026-14836 Login/Signup Popup < 3.2.5 - Unauthenticated Account Takeover via Password Reset Rate Limit Bypass

The Login & Register Forms WordPress plugin before 3.2.5 does not properly enforce the rate limit on its password-reset verification-code flow, keying both the verification code and the per-source attempt counter on an unauthenticated, client-controlled value, allowing unauthenticated attackers t...

EUVD-2013-4795

Malware in sbrugna...

EUVD-2025-28389

Malicious code in bioql PyPI...

EUVD-2024-46839

Malicious code in bioql PyPI...

EUVD-2025-28356

Malicious code in bioql PyPI...

CVE-2025-9887 Custom Login And Signup Widget <= 1.0 - Cross-Site Request Forgery

The Custom Login And Signup Widget plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.0. This is due to missing or incorrect nonce validation in the /frndzkadminclsw.php file. This makes it possible for unauthenticated attackers to change the...

CVE-2025-51092

The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn and signUp build queries by directly concatenating user input and unvalidated table names without using prepared statements. While a prepareDat...

PT-2025-34487 · Vishnusivadasvs · Login-Signup

Name of the Vulnerable Software and Affected Versions: LogIn-SignUp project by VishnuSivadasVS affected versions not specified Description: The LogIn-SignUp project is susceptible to SQL Injection due to the construction of SQL queries in the DataBase.php file. The logIn and signUp functions...

CVE-2025-51092

The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn and signUp build queries by directly concatenating user input and unvalidated table names without using prepared statements. While a prepareDat...

CVE-2025-51092: Improper Neutralization of Special Elements used in an SQL Command

The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to unsafe construction of SQL queries in DataBase.php. The functions logIn and signUp build queries by directly concatenating user input and unvalidated table names without using prepared statements. While a prepareDat...

CVE-2025-51092

The LogIn-SignUp project by VishnuSivadasVS is vulnerable to SQL Injection due to insecure query construction in the DataBase.php file. The logIn() and signUp() functions concatenate user input and unvalidated table names directly into SQL queries, bypassing the use of prepared statements. Althou...

CVE-2025-50027

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows Stored XSS.This issue affects Login/Signup Popup: from n/a through = 2.9.4...

CVE-2025-50027 WordPress Login/Signup Popup plugin <= 2.9.4 - Cross Site Scripting (XSS) Vulnerability

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows Stored XSS.This issue affects Login/Signup Popup: from n/a through = 2.9.4...

PT-2025-26384 · Unknown · Xootix Login/Signup Popup

Name of the Vulnerable Software and Affected Versions: xootix Login/Signup Popup versions n/a through 2.9.4 Description: The issue is related to Improper Neutralization of Input During Web Page Generation, also known as Cross-site Scripting, which allows Stored XSS in the xootix Login/Signup Popu...

CVE-2025-50027: Improper Neutralization of Input During Web Page Generation

Improper Neutralization of Input During Web Page Generation 'Cross-site Scripting' vulnerability in xootix Login/Signup Popup easy-login-woocommerce allows Stored XSS.This issue affects Login/Signup Popup: from n/a through = 2.9.4...