WordPress plugin Admin SMS Alert 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed in the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPress...

PT-2024-34781 · Unknown · Admin Sms Alert

Name of the Vulnerable Software and Affected Versions: Admin SMS Alert versions n/a through 1.1.0 Description: The issue is related to a Cross-Site Request Forgery CSRF vulnerability that allows Stored XSS. This means an attacker can trick a user into performing unintended actions on a web...

The vulnerability in the script htdocs/webinc/body/bsc_sms_send.php of the D-Link DIR-860L, DIR-865L, DIR-868L, DIR-880L routers allows a attacker to execute an XSS attack.

The vulnerability in the script htdocs/webinc/body/bscsmssend.php of the D-Link DIR-860L, DIR-865L, DIR-868L, and DIR-880L routers is related to improper validation of input data. Exploiting this vulnerability allows an attacker to execute XSS attacks through a specially created parameter for the...

CVE-2024-51688

Cross-Site Request Forgery CSRF vulnerability in fraudlabspro FraudLabs Pro SMS Verification fraudlabs-pro-sms-verification allows Stored XSS.This issue affects FraudLabs Pro SMS Verification: from n/a through = 1.10.1...

CVE-2024-51688 WordPress FraudLabs Pro SMS Verification plugin <= 1.10.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in fraudlabspro FraudLabs Pro SMS Verification fraudlabs-pro-sms-verification allows Stored XSS.This issue affects FraudLabs Pro SMS Verification: from n/a through = 1.10.1...

CVE-2024-51688 WordPress FraudLabs Pro SMS Verification plugin <= 1.10.1 - CSRF to Stored XSS vulnerability

Cross-Site Request Forgery CSRF vulnerability in fraudlabspro FraudLabs Pro SMS Verification fraudlabs-pro-sms-verification allows Stored XSS.This issue affects FraudLabs Pro SMS Verification: from n/a through = 1.10.1...

CVE-2024-51688

CVE-2024-51688 — FraudLabs Pro SMS Verification (WordPress) A CSRF-induced Cross‑Site Scripting vulnerability exists in the FraudLabs Pro SMS Verification WordPress plugin for versions up to 1.10.1. The issue allows a stored XSS payload to be injected and persisted via a CSRF context. Reported un...

WordPress plugin FraudLabs Pro SMS Verification 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. A cross-site request forgery...

PT-2024-34834 · Fraudlabs Pro · Fraudlabs Pro Sms Verification

Name of the Vulnerable Software and Affected Versions: FraudLabs Pro SMS Verification versions 1.10.1 and earlier Description: A Cross-Site Request Forgery CSRF issue exists in FraudLabs Pro SMS Verification, allowing Stored XSS. Recommendations: For versions 1.10.1 and earlier, update to a versi...

Crooks bank on Microsoft&#8217;s search engine to phish customers

We identified a new wave of phishing for banking credentials that targets consumers via Microsoft's search engine. A Bing search query for 'Keybank login' currently returns malicious links on the first page, and sometimes as the top search result. We have reported the fraudulent sites to Microsof...

WordPress FraudLabs Pro SMS Verification plugin <= 1.10.1 - CSRF to Stored XSS vulnerability

CSRF to Stored XSS vulnerability discovered by SOPROBRO Patchstack Alliance in WordPress Plugin FraudLabs Pro SMS Verification versions = 1.10.1...

WordPress Admin SMS Alert plugin <= 1.1.0 - CSRF to Stored Cross Site Scripting (XSS) vulnerability

CSRF to Stored Cross Site Scripting XSS vulnerability discovered by Joshua Chan Patchstack Alliance in WordPress Plugin Admin SMS Alert versions = 1.1.0...

WordPress FraudLabs Pro SMS Verification Plugin <= 1.10.1 is vulnerable to Cross Site Request Forgery (CSRF)

Software FraudLabs Pro SMS Verification Type Plugin Vulnerable versions = 1.10.1 Fixed in 1.10.2 OWASP Top 10 A1: Broken Access Control Classification Cross Site Request Forgery CSRF CVE CVE-2024-51688 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 7924a0d6c9b2 Credits...

WordPress Admin SMS Alert Plugin <= 1.1.0 is vulnerable to Cross Site Request Forgery (CSRF)

Software Admin SMS Alert Type Plugin Vulnerable versions = 1.1.0 Fixed in N/A OWASP Top 10 A3: Injection Classification Cross Site Request Forgery CSRF CVE CVE-2024-51637 Patch priority Low CVSS severity Low 7.1 Developer Claim ownership PSID 1c184ecc3a88 Credits Joshua Chan Required privilege...

CVE-2024-10233

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sasubscribe shortcode in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

CVE-2024-10233

CVE-2024-10233 affects the SMS Alert Order Notifications – WooCommerce WordPress plugin. It is vulnerable in all versions up to and including 3.7.5 due to insufficient input sanitization and output escaping on the sa_subscribe shortcode attributes, enabling an authenticated attacker with contribu...

CVE-2024-10233 SMSAlert - WooCommerce <= 3.7.5 - Authenticated (Contributor+) Stored Cross-Site Scripting via sa_subscribe Shortcode

The SMS Alert Order Notifications – WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's sasubscribe shortcode in all versions up to, and including, 3.7.5 due to insufficient input sanitization and output escaping on user supplied attributes. This makes i...

PT-2024-16130 · WordPress · Sms Alert Order Notifications

Name of the Vulnerable Software and Affected Versions: SMS Alert Order Notifications – WooCommerce plugin for WordPress versions up to, and including, 3.7.5 Description: The issue is related to Stored Cross-Site Scripting via the plugin's sa subscribe shortcode due to insufficient input...

CVE-2024-10195

A vulnerability was found in Tecno 4G Portable WiFi TR118 V008-20220830. It has been declared as critical. Affected by this vulnerability is an unknown functionality of the file /goform/goformgetcmdprocess of the component SMS Check. The manipulation of the argument orderby leads to sql injection...

CVE-2024-10195

The CVE-2024-10195 entry concerns Tecno 4G Portable WiFi TR118 (V008-20220830). A vulnerability exists in the SMS Check module via the endpoint /goform/goform_get_cmd_process where manipulation of the order_by argument enables SQL injection. Exploitation is described as remote. Several sources co...