iQ Block Country < 1.2.13 - Admin+ Arbitrary File Deletion via Zip Slip

The settings of the plugin can be exported or imported using its backup functionality. An authorized user can import preconfigured settings of the plugin by uploading a zip file. After the uploading process, files in the uploaded zip file are extracted one by one. During the extraction process,...

WordPress WooCommerce Dynamic Pricing & Discounts premium plugin <= 2.4.1 - Unauthenticated Settings Import and Stored XSS vulnerability

Unauthenticated Settings Import and Stored XSS vulnerability discovered by Jerome Bruandet NinTechNet in WordPress WooCommerce Dynamic Pricing & Discounts premium plugin versions = 2.4.1. Solution Update the WordPress WooCommerce Dynamic Pricing & Discounts premium plugin to the latest available...

CVE-2020-11689

CVE-2020-11689 affects JetBrains TeamCity prior to 2019.2.1. A security issue in access control allowed a user with insufficient permissions to import settings from settings.kts. The issue is documented across multiple sources (NVD entry for CVE-2020-11689 and JetBrains’ Q1 2020 Security Bulletin...

CVE-2020-11689: Incorrect Default Permissions

In JetBrains TeamCity before 2019.2.1, a user without appropriate permissions was able to import settings from the settings.kts file...

WordPress LoginPress Plugin Authorization Issue Vulnerability

WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.LoginPress is a login page customization plugin used in it. An authorization issue vulnerability exists in the WordPress LoginPress...

CVE-2019-15872

The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings...

CVE-2019-15872

The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings...

Sql injection

The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings...

CVE-2019-15872

The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings...

CVE-2019-15872: Improper Neutralization of Special Elements used in an SQL Command

The LoginPress plugin before 1.1.4 for WordPress has SQL injection via an import of settings...

LoginPress <= 1.1.15 - Authenticated Blind SQL Injection

Blind time-based SQL injection, combined with lack of permission check resulted in an unauthorised attack which can be performed by any user on the site including subscriber profiles. 1. Lack of permission check in settings import Similar to our recent analysis, this vulnerability was also caused...

WinRar 5.30 beta 4 - Settings Import Command Execution Exploit

Exploit for windows platform in category local exploits !/usr/bin/python -w Title : WinRar Settings Import Command Execution Date : 02/10/2015 Author : R-73eN Tested on : Windows 7 Ultimate Vulnerable Versions : Winrar 5.30 beta 4 The vulnerability exists in the "Import Settings From File"...

WinRar < 5.30 Beta 4 - Settings Import Command Execution

!/usr/bin/python -w Title : WinRar Settings Import Command Execution Date : 02/10/2015 Author : R-73eN Tested on : Windows 7 Ultimate Vulnerable Versions : Winrar 5.30 beta 4 The vulnerability exists in the "Import Settings From File" function. Since Settings file of Winrar are saved as a registr...