86 matches found
CVE-2024-3293-Poc
CVE-2024-3293-Poc rtMedia for WordPress, BuddyPress and bbPress get \buddypress-media\app\helper\RTMediaModel.php:61 RTMediaModel-getmedia \buddypress-media\app\helper\RTMediaModel.php:227 RTMediaQuery-populatemedia \buddypress-media\app\main\routers\query\RTMediaQuery.php:869...
CVE-2026-88912
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...
CVE-2026-88912 rtMedia for WordPress, BuddyPress and bbPress < 4.7.12 - Subscriber+ Arbitrary Activity Privacy Modification via IDOR
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...
EUVD-2026-76957
The rtMedia for WordPress, BuddyPress and bbPress WordPress plugin before 4.7.12 does not check ownership before changing the privacy level of an activity and its attached media, relying only on a nonce shared with every logged-in user, allowing users with a subscriber-level account or above to...
CVE-2026-88912
The rtMedia for WordPress, BuddyPress and bbPress plugin before 4.7.12 contains an IDOR -type flaw: it does not verify ownership before changing the privacy level of an activity and its attached media, relying solely on a nonce shared with every logged-in user . As a result, any user with a subsc...
CVE-2026-16482
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
EUVD-2026-76828
The rtMedia for WordPress, BuddyPress and bbPress plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'compare' parameter in all versions up to, and including, 4.7.11 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the...
CVE-2026-16482
The rtMedia for WordPress, BuddyPress and bbPress plugin (up to and including 4.7.11 ) is vulnerable to an unauthenticated time-based blind SQL Injection via the compare parameter. The root cause lies in RTMediaQuery::query(), which merges $_REQUEST into the internal query while only validating t...
CVE-2026-66592
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...
EUVD-2026-63335
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...
CVE-2026-66592
An unauthenticated SQL injection vulnerability affects the rtMedia plugin for WordPress, BuddyPress, and bbPress at versions 4.7.11 and below. With a CVSS 3.1 base score of 9.3 (Critical), it allows remote attackers with no credentials to execute arbitrary SQL queries, potentially exposing sensit...
CVE-2026-66592 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.11 - SQL Injection vulnerability
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.11 versions...
CVE-2026-59551
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-59549
Unauthenticated SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-59551 WordPress rtMedia for WordPress, BuddyPress and bbPress plugin <= 4.7.10 - SQL Injection vulnerability
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
EUVD-2026-49220
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-59551
The CVE-2026-59551 entry concerns the WordPress plugin rtMedia for WordPress, BuddyPress and bbPress (versions up to 4.7.10). The issue is a SQL Injection vulnerability in subscriber handling within this plugin. Public details in the provided documents specify affected software and the underlying...
CVE-2026-59551
Subscriber SQL Injection in rtMedia for WordPress, BuddyPress and bbPress = 4.7.10 versions...
CVE-2026-59549
Affected software: WordPress plugin rtMedia for WordPress, BuddyPress and bbPress (versions <= 4.7.10). Vulnerability: Unauthenticated SQL Injection. Root cause/impact: SQL injection that does not require authentication; CVSS metrics in the external record indicate high confidentiality impact ...