WordPress LoginPress Pro Plugin < 3.0.0 is vulnerable to Settings Change

Software LoginPress Pro Type Plugin Vulnerable versions 3.0.0 Fixed in 3.0.0 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-32677 Patch priority Low CVSS severity Low 6.5 Developer Claim ownership PSID 4886360ccb57 Credits Dave Jong Patchstack Required privileg...

WordPress Bricksforge plugin <= 2.0.17 - Unauthenticated Arbitrary WordPress Settings Change vulnerability

Unauthenticated Arbitrary WordPress Settings Change vulnerability discovered by Dave Jong Patchstack in WordPress Plugin Bricksforge versions = 2.0.17...

WordPress Bricksforge Plugin <= 2.0.17 is vulnerable to Settings Change

Software Bricksforge Type Plugin Vulnerable versions = 2.0.17 Fixed in 2.1.1 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-31244 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID 14424e64b823 Credits Dave Jong Patchstack Required...

WordPress Bricksforge Plugin <= 2.0.17 is vulnerable to Settings Change

Software Bricksforge Type Plugin Vulnerable versions = 2.0.17 Fixed in 2.1.1 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-31243 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID 5546b5d0d458 Credits Dave Jong Patchstack Required...

CVE-2024-28013

CVE-2024-28013 concerns NEC Aterm devices (e.g., WG1800HP4, WG1200HS3, WG1900HP2, WG1200HP2, WG1200HS, WG1800HP, W1200EX-MS, CR2500P, WR8200N, WM3800R, WG1810HP, MR01LN, MR02LN, and many other WG/WG/WF/WR/WL models) where the vulnerability stems from Use of Insufficiently Random Values. The issue...

CVE-2024-22156 WordPress SalesKing plugin <= 1.6.15 - Unauthenticated Plugin Settings Change vulnerability

Missing Authorization vulnerability in SNP Digital SalesKing.This issue affects SalesKing: from n/a through 1.6.15...

CVE-2024-29071

CVE-2024-29071 affects HGW BL1500HM (ver. ≤002.001.013). The issue is use of weak credentials allowing a network-adjacent, unauthenticated attacker to change system settings. JVN detects multiple vulnerabilities in the same device family and notes the vendor fixed these issues in 002.001.019; Red...

KDDI HGW BL1500HM 安全漏洞

The KDDI HGW BL1500HM is a home router from KDDI Japan. A security vulnerability exists in KDDI HGW BL1500HM version 002.001.013 and prior versions. An attacker exploiting this vulnerability may be able to change system settings...

CVE-2024-25912 WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary WordPress Settings Change vulnerability

Missing Authorization vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2...

CVE-2024-25912 WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary WordPress Settings Change vulnerability

Missing Authorization vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2...

CVE-2023-27607 WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Settings Change vulnerability

Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0...

CVE-2023-27607 WordPress Points and Rewards for WooCommerce plugin <= 1.5.0 - Settings Change vulnerability

Missing Authorization vulnerability in WP Swings Points and Rewards for WooCommerce.This issue affects Points and Rewards for WooCommerce: from n/a through 1.5.0...

WordPress Rolo Slider Plugin <= 1.0.9 is vulnerable to Settings Change

Software Rolo Slider Type Plugin Vulnerable versions = 1.0.9 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-1438 Patch priority High CVSS severity High 7.7 Developer Claim ownership PSID 601d954731d6 Credits Emili Castells Required privilege...

CVE-2024-23785

Cross-site request forgery vulnerability in Energy Management Controller with Cloud Services JH-RVB1 /JH-RV11 Ver.B0.1.9.1 and earlier allows a remote unauthenticated attacker to change the product settings...

WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Settings Change

Software WP Media folder Type Plugin Vulnerable versions = 5.7.2 Fixed in 5.7.3 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-25908 Patch priority Low CVSS severity Low 4.3 Developer Claim ownership PSID 54ad5de45957 Credits Dave Jong Patchstack Required...

WordPress MoveTo Plugin <= 6.2 is vulnerable to Settings Change

Software MoveTo Type Plugin Vulnerable versions = 6.2 Fixed in N/A OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-25912 Patch priority High CVSS severity High 9.8 Developer Claim ownership PSID b88d3d6ad2fe Credits Dave Jong Patchstack Required privilege...

WordPress WP Media folder Plugin <= 5.7.2 is vulnerable to Settings Change

Software WP Media folder Type Plugin Vulnerable versions = 5.7.2 Fixed in 5.7.3 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-25907 Patch priority Low CVSS severity Low 5.4 Developer Claim ownership PSID 67f969090926 Credits Dave Jong Patchstack Required...

WordPress PowerPack Pro for Elementor Plugin <= 2.10.6 is vulnerable to Settings Change

Software PowerPack Pro for Elementor Type Plugin Vulnerable versions = 2.10.6 Fixed in 2.10.8 OWASP Top 10 A1: Broken Access Control Classification Settings Change CVE CVE-2024-24844 Patch priority High CVSS severity High 7.5 Developer Claim ownership PSID ad539f87b78f Credits Dave Jong Patchstac...

WordPress plugin WP SOCIAL BOOKMARK MENU security vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. A security vulnerability exists in...

Travelpayouts < 1.1.13 - Settings Update via CSRF

Description The plugin does not have CSRF check in place when importing settings from the v1, which could allow attackers to make a logged in admin update some settings via a CSRF attack PoC Make a logged in admin open a page containing the HTML code below, this will make them update the plugin's...