4666 matches found
Cross site request forgery (csrf)
The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the editmetavalue function. This makes it possible for unauthenticated attackers to edit meta field values vi...
CVE-2021-4394 Locations <= 3.2.1 - Cross-Site Request Forgery Bypass
The Locations plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.2.1. This is due to missing or incorrect nonce validation on the saveCustomFields function. This makes it possible for unauthenticated attackers to update custom field meta data via ...
CVE-2020-36743 Product Catalog Simple <= 1.5.13 - Cross-Site Request Forgery Bypass
The Product Catalog Simple plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.5.13. This is due to missing or incorrect nonce validation on the implecodesaveproductsmeta function. This makes it possible for unauthenticated attackers to update...
CVE-2021-4392 eCommerce Product Catalog Plugin for WordPress <= 2.9.43 - Cross-Site Request Forgery Bypass
The eCommerce Product Catalog Plugin for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.9.43. This is due to missing or incorrect nonce validation on the implecodesaveproductsmeta function. This makes it possible for unauthenticated...
CVE-2020-36742 Custom Field Template <= 2.5.1 - Cross-Site Request Forgery Bypass
The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the editmetavalue function. This makes it possible for unauthenticated attackers to edit meta field values vi...
CVE-2020-36742 Custom Field Template <= 2.5.1 - Cross-Site Request Forgery Bypass
The Custom Field Template plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.5.1. This is due to missing or incorrect nonce validation on the editmetavalue function. This makes it possible for unauthenticated attackers to edit meta field values vi...
PT-2023-12510 · WordPress · Amministrazione Trasparente
Name of the Vulnerable Software and Affected Versions: Amministrazione Trasparente plugin for WordPress versions up to, and including, 7.1 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the at save aturl meta function. This allows...
PT-2023-12504 · WordPress · Ecommerce Product Catalog Plugin
Name of the Vulnerable Software and Affected Versions: eCommerce Product Catalog Plugin for WordPress versions up to, and including, 2.9.43 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the implecode save products meta function. Th...
PT-2023-11886 · WordPress · Menu Swapper
Name of the Vulnerable Software and Affected Versions: Menu Swapper plugin for WordPress versions up to, and including, 1.1.0.2 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the mswp save meta function. This allows unauthenticated...
WordPress Plugin Custom Field Template 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. WordPress plugin is an application plugin that supports personal blogs on PHP and MySQL servers. A cross-site request forgery vulnerability exists in...
WordPress Plugin Menu Swapper 跨站请求伪造漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...
WordPress Plugin Ultimate Member 权限许可和访问控制问题漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A vulnerability exists in WordPress Plugin...
Submarine Cables Face Escalating Cybersecurity Threats, Report
By Waqas The report also raises concerns about the increasing influence of hyperscale companies like Amazon, Google, Meta, and Microsoft in the global cable network, potentially leading to market monopolies and challenges to digital sovereignty. This is a post from HackRead.com Read the original...
CVE-2023-3427
The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...
CVE-2023-3427 Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer
The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...
CVE-2023-3427 Salon Booking System <= 8.4.6 - Cross-Site Request Forgery to Admin Role Change to Customer, User Meta Update via save_customer
The Salon Booking System plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 8.4.6. This is due to missing or incorrect nonce validation on the 'savecustomer' function. This makes it possible for unauthenticated attackers to change the admin role to...
PT-2023-24785 · WordPress · Salon Booking System
Name of the Vulnerable Software and Affected Versions: The Salon Booking System plugin for WordPress versions up to, and including, 8.4.6 Description: The issue is due to missing or incorrect nonce validation on the save customer function, making it possible for unauthenticated attackers to chang...
CVE-2023-35173
Nextcloud End-to-end encryption app provides all the necessary APIs to implement End-to-End encryption on the client side. By providing an invalid meta data file, an attacker can make previously dropped files inaccessible. It is recommended that the Nextcloud End-to-end encryption app is upgraded...
