277 matches found
CVE-2023-2201
The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘postid’ parameter in versions up to, and including, 1.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
CVE-2023-2201
The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘postid’ parameter in versions up to, and including, 1.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
Sql injection
The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘postid’ parameter in versions up to, and including, 1.6.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated...
PT-2023-18361 · WordPress · Web Directory Free
Name of the Vulnerable Software and Affected Versions: The Web Directory Free for WordPress versions up to, and including, 1.6.7 Description: The issue allows authenticated attackers with contributor-level privileges to extract sensitive information from the database due to insufficient escaping ...
CVE-2023-29528
creationtimestamp| type| source ---|---|--- 2023-04-20 22:31:01+00:00| seen| https://t.me/cibsecurity/62547 2025-08-22 21:02:34+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lwze4vwi5d2n...
real.Kit < 5.1.1 - Contributor+ Stored XSS
The plugin does not validate and escape some of its shortcode attributes before outputting them back in a page/post where the shortcode is embed, which could allow users with the contributor role and above to perform Stored Cross-Site Scripting attacks. modal open='1' class='" onmouseover="alert1...
CVE-2021-36570
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---...
CVE-2021-36569
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2...
Cross site request forgery (csrf)
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /permissions/delete/2---...
CVE-2021-36569
Cross Site Request Forgery vulnerability in FUEL-CMS 1.4.13 allows remote attackers to run arbitrary code via post ID to /users/delete/2...
PT-2023-12290 · Fuel Cms · Fuel Cms
Name of the Vulnerable Software and Affected Versions: FUEL-CMS version 1.4.13 Description: The issue allows remote attackers to run arbitrary code via post ID to the "/users/delete/2" API endpoint. This is a Cross Site Request Forgery vulnerability. Recommendations: For FUEL-CMS version 1.4.13, ...
An attacker can view private posts
Description The bookmark saving functionality performs improper authorization check. To exploit this, an attacker is required to know the target post ID. This is done via share link or by less possibly brute-forcing. Proof of Concept 1. victim Create a new post whose visibility is Followers Only...
WP FullCalendar < 1.5 - Unauthenticated Arbitrary Post Access
The plugin does not ensure that the post retrieved via an AJAX action is public and can be accessed by the user making the request, allowing unauthenticated attackers to get the content of arbitrary posts, including draft/private as well as password-protected ones. Open the below URL as an...
GeoDirectory < 2.2.22 - Contributor+ Stored XSS via Shortcode
The plugin does not validate and escape some of its shortcode attributes before outputting them back in the page, which could allow users with a role as low as contributor to perform Stored Cross-Site Scripting attacks which could be used against high privilege users such as admins. Note: First,...
PT-2022-24126 · Unknown · Tim Campus Confession Wall
Name of the Vulnerable Software and Affected Versions: Tim Campus Confession Wall affected versions not specified Description: A critical issue has been found in Tim Campus Confession Wall, affecting an unknown functionality of the file share.php. The manipulation of the post id argument leads to...
Simple E-Learning System SQL注入漏洞
Simple E-Learning System is a simple e-learning system from Carlo Montero's personal developer. Simple E-Learning System is vulnerable to SQL injection, which stems from a missing validation of external input SQL statements in the parameter postid of the file commentframe.php. statement. An...
PT-2022-18148 · Sourcecodester · Sourcecodester Simple E-Learning System
Name of the Vulnerable Software and Affected Versions: SourceCodester Simple E-Learning System affected versions not specified Description: A critical issue was found in the SourceCodester Simple E-Learning System, affecting an unknown function of the file comment frame.php. The manipulation of t...
CVE-2022-23082
creationtimestamp| type| source ---|---|--- 2022-05-31 18:23:46+00:00| seen| https://t.me/cibsecurity/43565 2025-08-17 21:02:26+00:00| seen| https://bsky.app/profile/beikokucyber.bsky.social/post/3lwmrsaspw72n...
CVE-2022-24897
creationtimestamp| type| source ---|---|--- 2022-05-21 06:42:43+00:00| seen| https://t.me/cibsecurity/41789 2025-04-22 18:03:27+00:00| published-proof-of-concept| https://t.me/DarkWebInformerCVEAlerts/12915 2025-08-21 21:02:35+00:00| seen|...