362 matches found
CVE-2026-3568 MStore API <= 4.18.3 - Authenticated (Subscriber+) Insecure Direct Object Reference to Arbitrary User Meta Update
The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the updateuserprofile function in controllers/flutter-user.php processing the 'metadata' JSON parameter without any allowlist, blocklist, or validatio...
CVE-2026-3568
CVE-2026-3568 affects the WordPress MStore API plugin up to version 4.18.3. The root cause is in update_user_profile() processing the raw JSON field 'meta_data' without validation, allowlisting, or sanitization, and then applying arbitrary keys/values to update_user_meta() after cookie-based auth...
CVE-2026-3568
The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the updateuserprofile function in controllers/flutter-user.php processing the 'metadata' JSON parameter without any allowlist, blocklist, or validatio...
WordPress plugin MStore API 安全漏洞
WordPress and WordPress plugins are both products of the WordPress Foundation. WordPress is a blog platform developed using the PHP language. This platform allows for the creation of personal blog websites on servers based on PHP and MySQL. A WordPress plugin is an application extension. There is...
CVE-2026-3568: Authorization Bypass Through User-Controlled Key
The MStore API plugin for WordPress is vulnerable to Insecure Direct Object Reference in all versions up to, and including, 4.18.3. This is due to the updateuserprofile function in controllers/flutter-user.php processing the 'metadata' JSON parameter without any allowlist, blocklist, or validatio...
WordPress MStore API <= 4.0.1 - Unauthenticated SQL Injection
MStore API plugin for WordPress up to version 4.0.1 contains an unauthenticated blind SQL injection caused by insufficient escaping of 'id' parameter in SQL queries, letting attackers execute arbitrary SQL commands without authentication, exploit requires sending crafted requests with malicious...
CVE-2023-45055
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in InspireUI MStore API allows SQL Injection.This issue affects MStore API: from n/a through 4.0.6...
EUVD-2021-11062
Malware in sbrugna...
EUVD-2020-24155
Malware in sbrugna...
EUVD-2023-43887
Malicious code in bioql PyPI...
EUVD-2023-43875
Malicious code in bioql PyPI...
EUVD-2023-43880
Malicious code in bioql PyPI...
EUVD-2024-50553
Malicious code in bioql PyPI...
EUVD-2023-43881
Malicious code in bioql PyPI...
EUVD-2023-43816
Malicious code in bioql PyPI...
EUVD-2024-47442
Malicious code in bioql PyPI...
EUVD-2024-48517
Malicious code in bioql PyPI...
EUVD-2022-50374
Malicious code in bioql PyPI...