WordPress final-user-wp-frontend-user-profiles Plugin < 1.2.2 is vulnerable to Privilege Escalation

Software final-user-wp-frontend-user-profiles Type Plugin Vulnerable versions 1.2.2 Fixed in 1.2.2 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2020-36666 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 5182d2b5fe29 Credits Omar Badr...

WordPress Complianz Premium Plugin < 6.4.2 is vulnerable to Cross Site Scripting (XSS)

Software Complianz Premium Type Plugin Vulnerable versions 6.4.2 Fixed in 6.4.2 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-1069 Patch priority Medium CVSS severity Medium 6.5 Developer Claim ownership PSID 9c9adcf0c943 Credits Erwan LR WPScan...

WordPress real-estate-pro Plugin < 1.7.1 is vulnerable to Privilege Escalation

Software real-estate-pro Type Plugin Vulnerable versions 1.7.1 Fixed in 1.7.1 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2020-36666 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID a8f610e7b2fc Credits Omar Badran Required privilege...

WordPress photographer-directory Plugin < 1.0.9 is vulnerable to Privilege Escalation

Software photographer-directory Type Plugin Vulnerable versions 1.0.9 Fixed in 1.0.9 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2020-36666 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 44093df6ab0d Credits Omar Badran Required...

WordPress WP Shamsi Plugin <= 4.3.3 is vulnerable to Arbitrary File Deletion

Software WP Shamsi Type Plugin Vulnerable versions = 4.3.3 Fixed in N/A OWASP Top 10 A5: Broken Access Control Classification Arbitrary File Deletion CVE CVE-2023-0335 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 28e13116883e Credits Lana Codes Required privilege...

WordPress Advanced Shipment Tracking for WooCommerce Plugin <= 3.5.2 is vulnerable to Cross Site Request Forgery (CSRF)

Software Advanced Shipment Tracking for WooCommerce Type Plugin Vulnerable versions = 3.5.2 Fixed in 3.5.3 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2022-41635 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 7b3ec3a5415d...

WordPress OAuth Single Sign On - SSO (OAuth Client) Premium Plugin < 38.4.9 is vulnerable to Cross Site Request Forgery (CSRF)

Software OAuth Single Sign On - SSO OAuth Client Premium Type Plugin Vulnerable versions 38.4.9 Fixed in 48.4.9 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-1092 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID...

WordPress institutions-directory Plugin < 1.3.1 is vulnerable to Privilege Escalation

Software institutions-directory Type Plugin Vulnerable versions 1.3.1 Fixed in 1.3.1 OWASP Top 10 A5: Broken Access Control Classification Privilege Escalation CVE CVE-2020-36666 Patch priority High CVSS severity High 8.8 Developer Claim ownership PSID 3f4ecdce4fb1 Credits Omar Badran Required...

WordPress WP Statistics Plugin < 14.0 is vulnerable to SQL Injection

Software WP Statistics Type Plugin Vulnerable versions 14.0 Fixed in 14.0 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-0955 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 442f3d5af675 Credits Erwan LR WPScan Required privilege Administrator Publish...

WordPress WP Dark Mode Plugin < 4.0.8 is vulnerable to Local File Inclusion

Software WP Dark Mode Type Plugin Vulnerable versions 4.0.8 Fixed in 4.0.8 OWASP Top 10 A1: Injection Classification Local File Inclusion CVE CVE-2023-0467 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID b9de22c09750 Credits Alex Sanford Required privilege Subscriber...

ZKTeco ZEM/ZMM 8.88 - Missing Authentication Vulnerability

Exploit Title: ZKTeco ZEM/ZMM 8.88 - Missing Authentication Exploit Author: RedTeam Pentesting GmbH CVE: CVE-2022-42953 Advisory: Missing Authentication in ZKTeco ZEM/ZMM Web Interface The ZKTeco time attendance device does not require authentication to use the web interface, exposing the databas...

nanofine.co.kr Cross Site Scripting vulnerability OBB-3237955

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

alicomm.com Cross Site Scripting vulnerability OBB-3237818

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

thegreatresidence.com Cross Site Scripting vulnerability OBB-3237570

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

suburbanbhs.com Cross Site Scripting vulnerability OBB-3236952

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

appregistrovisitatori.com Cross Site Scripting vulnerability OBB-3236692

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

sproutstudioqa.com Cross Site Scripting vulnerability OBB-3236681

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...

WordPress Albo Pretorio Online Plugin <= 4.6 is vulnerable to Cross Site Scripting (XSS)

Software Albo Pretorio Online Type Plugin Vulnerable versions = 4.6 Fixed in 4.6.1 OWASP Top 10 A7: Cross-Site Scripting XSS Classification Cross Site Scripting XSS CVE CVE-2023-28750 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID 4e28c2ad9283 Credits Phd Required...

WordPress Advanced Page Visit Counter Plugin <= 6.4.2 is vulnerable to SQL Injection

Software Advanced Page Visit Counter Type Plugin Vulnerable versions = 6.4.2 Fixed in 6.4.2.1 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2023-28788 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID df149d5b7d44 Credits minhtuanact Required privilege...

revizorskotijelo.me Cross Site Scripting vulnerability OBB-3236096

Following the coordinated and responsible vulnerability disclosure guidelines of the ISO 29147 standard, Open Bug Bounty has: a. verified the vulnerability and confirmed its existence; b. notified the website operator about its existence. Technical details of the vulnerability are currently hidde...