PT-2024-15142 · WordPress · Getwid

Name of the Vulnerable Software and Affected Versions: Getwid – Gutenberg Blocks plugin for WordPress versions prior to 2.0.4 Description: The issue allows unauthorized modification of data due to a missing capability check on the recaptcha api key manage function. This makes it possible for...

Getwid – Gutenberg Blocks < 2.0.5 - Missing Authorization to Recaptcha API Key Modification

Description The plugin is vulnerable to unauthorized modification of data due to a missing capability check on the recaptchaapikeymanage function in all versions up to, and including, 2.0.3. This makes it possible for authenticated attackers, with subscriber-level access and above, to add, modify...

CVE-2023-48654

One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: go to the...

CVE-2023-48654

One Identity Password Manager before 5.13.1 allows Kiosk Escape. This product enables users to reset their Active Directory passwords on the login screen of a Windows client. It launches a Chromium based browser in Kiosk mode to provide the reset functionality. The escape sequence is: go to the...

Shifting from reCAPTCHA to hCaptcha

We are adding another CAPTCHA vendor and helping our customers migrate from Googles reCAPTCHA to hCaptcha. Why We Are Making This Change We continuously evaluate our security measures to ensure they align with the evolving landscape of threats. After carefully evaluating several different CAPTCHA...

One Identity Password Manager Kiosk Escape Privilege Escalation

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Kiosk Escape Privilege Escalation product: One Identity Password Manager Secure Password Extension vulnerable version: 5.13.1 fixed version: 5.13.1 CVE number:...

CVE-2023-28167

Cross-Site Request Forgery CSRF vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin = 1.3.3 versions...

CVE-2023-28167

Cross-Site Request Forgery CSRF vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin = 1.3.3 versions...

Cross site request forgery (csrf)

Cross-Site Request Forgery CSRF vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin = 1.3.3 versions...

CVE-2023-28167 WordPress CF7 Invisible reCAPTCHA Plugin <= 1.3.3 is vulnerable to Cross Site Request Forgery (CSRF)

Cross-Site Request Forgery CSRF vulnerability in Vsourz Digital CF7 Invisible reCAPTCHA plugin = 1.3.3 versions...

CVE-2023-28167

CVE-2023-28167 is a CSRF vulnerability in the WordPress plugin CF7 Invisible reCAPTCHA (Vsourz Digital). Affected versions are

WordPress Plugin CF7 Invisible reCAPTCHA Cross-Site Request Forgery Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. WordPress Plugin CF7 Invisible reCAPTCHA A...

PT-2023-21603 · Vsourz Digital · Vsourz Digital Cf7 Invisible Recaptcha Plugin

Name of the Vulnerable Software and Affected Versions: Vsourz Digital CF7 Invisible reCAPTCHA plugin versions prior to 1.3.4 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability. This type of vulnerability allows an attacker to trick a user into performing unintend...

Exploit for Missing Authorization in Wpmet Metform_Elementor_Contact_Form_Builder

CVE-2022-1442 WordPress Plugin Metform = 2.1.3 - Improper...

WordPress CF7 ReCaptcha Mine Plugin <= 1.0.2 is vulnerable to Cross Site Scripting (XSS)

Software CF7 ReCaptcha Mine Type Plugin Vulnerable versions = 1.0.2 Fixed in 2.0.0 OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority High CVSS severity High 7.1 Developer Claim ownership PSID 98006570d580 Credits Rafie Muhammad Patchstack Require...

WordPress Custom Registration and Custom Login Forms with New Recaptcha Plugin <= 1.0.0 is vulnerable to Cross Site Scripting (XSS)

Software Custom Registration and Custom Login Forms with New Recaptcha Type Plugin Vulnerable versions = 1.0.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Scripting XSS CVE CVE-2023-33999 Patch priority Medium CVSS severity Medium 7.1 Developer Claim ownership PSID...

KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls

The plugin does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings PoC Run one of the below commands i...

KiviCare Management System < 3.2.1 - Subscriber+ Unauthorised AJAX Calls

The plugin does not have proper CSRF and authorisation checks in various AJAX actions, allowing any authenticated users, such as subscriber to call them. Attacks include but are not limited to: Add arbitrary Clinic Admin/Doctors/etc and update plugin's settings Run one of the below commands in th...

WordPress reCAPTCHA for all Plugin <= 1.22 is vulnerable to Broken Access Control

Software reCAPTCHA for all Type Plugin Vulnerable versions = 1.22 Fixed in 1.23 OWASP Top 10 A5: Broken Access Control Classification Broken Access Control CVE CVE-2023-32599 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 97d938ca1868 Credits Jonas Höbenreich Required...

WordPress CF7 Invisible reCAPTCHA Plugin <= 1.3.3 is vulnerable to Cross Site Request Forgery (CSRF)

Software CF7 Invisible reCAPTCHA Type Plugin Vulnerable versions = 1.3.3 Fixed in 1.3.4 OWASP Top 10 A5: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2023-28167 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 90191430a39a Credits Rio Darmawa...