CVE-2024-9697 Social Rocket – Social Sharing Plugin <= 1.3.4 - Missing Authorization to Settings Update

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweetsettingssave and tweetsettingsupdate functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated...

CVE-2024-9697

CVE-2024-9697 concerns the WordPress plugin Social Rocket – Social Sharing Plugin . The vulnerability is an unauthorized data modification flaw caused by a missing capability check in tweet_settings_save() and tweet_settings_update() across all versions up to and including 1.3.4. This permits aut...

CVE-2024-9697 Social Rocket – Social Sharing Plugin <= 1.3.4 - Missing Authorization to Settings Update

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweetsettingssave and tweetsettingsupdate functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated...

PT-2025-3735 · WordPress · The Social Rocket – Social Sharing Plugin

Name of the Vulnerable Software and Affected Versions: Social Rocket – Social Sharing Plugin versions up to and including 1.3.4 Description: The issue arises from insufficient input sanitization and output escaping on user-supplied attributes in the socialrocket-floating shortcode. This allows...

PT-2025-3734

Name of the Vulnerable Software and Affected Versions The Social Rocket – Social Sharing Plugin versions up to, and including, 1.3.4 Description The issue allows authenticated attackers with Subscriber-level access and above to update the plugin's settings due to a missing capability check on the...

CVE-2024-9702: Improper Neutralization of Input During Web Page Generation

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's 'socialrocket-floating' shortcode in all versions up to, and including, 1.3.4 due to insufficient input sanitization and output escaping on user supplied attributes. This...

CVE-2024-9697: Missing Authorization

The Social Rocket – Social Sharing Plugin plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the tweetsettingssave and tweetsettingsupdate functions in all versions up to, and including, 1.3.4. This makes it possible for authenticated...

WordPress plugin Social Rocket – Social Sharing Plugin 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

WordPress plugin Social Rocket 跨站脚本漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A cross-site scripting...

WordPress Social Rocket plugin <= 1.3.4 - Authenticated (Contributor+) Stored Cross-Site Scripting via Shortcode vulnerability

Authenticated Contributor+ Stored Cross-Site Scripting via Shortcode vulnerability discovered by Peter Thaleikis in WordPress Plugin Social Rocket versions = 1.3.4...

WordPress Social Rocket plugin <= 1.3.4 - Missing Authorization to Settings Update vulnerability

Missing Authorization to Settings Update vulnerability discovered by WordFence in WordPress Plugin Social Rocket versions = 1.3.4...

Exploit for Special Element Injection in Rocket.Chat

Rocket-Chat-3.12.1-PoC-CVE-2021-22911- 1. Go login page !...

VulnCheck KEV: CVE-2024-39713

A Server-Side Request Forgery SSRF affects Rocket.Chat's Twilio webhook endpoint before version 6.10.1...

The vulnerability of the E2EE Password Handler component in the server-based corporate messaging platform supporting file and video conferences like Rocket.Chat Mobile allows a hacker to escalate their privileges.

The vulnerability of the E2EE Password Handler component in the server-based corporate messaging system that supports file and video conferences in Rocket.Chat Mobile is related to the use of weak user credentials. Exploiting this vulnerability could allow a malicious actor to gain increased...

CVE-2024-46936

Rocket.Chat 6.12.0, 6.11.2, 6.10.5, 6.9.6, 6.8.6, 6.7.8, and before is vulnerable to a message forgery / impersonation issue. Attackers can abuse the UpdateOTRAck method to send ephemeral messages as if they were any other user they choose...

Rocket.Chat 安全漏洞

Rocket.Chat is a chat program from Rocket.Chat Inc. A security vulnerability exists in Rocket.Chat. An attacker exploiting this vulnerability is able to abuse the UpdateOTRAck method. The following versions are affected: version 6.12.0, version 6.11.2, version 6.10.5, version 6.9.6, version 6.8.6...

Rocket.Chat 安全漏洞

Rocket.Chat is a chat program from Rocket.Chat, Inc. A security vulnerability exists in Rocket.Chat that stems from storing cross-site scripting in the description and release notes of marketplace and private applications. The following versions are affected: version 6.12.0, version 6.11.2, versi...

PT-2024-32286 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions 6.12.0 through 6.7.8 and earlier Description: The issue allows attackers to craft messages with specific characters, potentially crashing the workspace due to a problem in the message parser. This can lead to a denial of...

PT-2024-32287 · Unknown · Rocket.Chat

Name of the Vulnerable Software and Affected Versions: Rocket.Chat versions 6.12.0 through 6.7.8 and before Description: The issue allows attackers to abuse the UpdateOTRAck method to send ephemeral messages as if they were any other user they choose, leading to a message forgery and impersonatio...

PT-2024-28648

Name of the Vulnerable Software and Affected Versions Rocket.Chat versions prior to 6.10.1 Description A Server-Side Request Forgery SSRF issue affects Rocket.Chat's Twilio webhook endpoint. This allows attackers to redirect requests, potentially risking sensitive data. Approximately 1781 IPs hav...