46 matches found
CVE-2026-88930
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-88930 Social Web Suite <= 4.1.12 - Unauthenticated Blind SQLi via Unset Shared Secret
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...
EUVD-2026-96779
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-88930
The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to SQL injection attacks. The root cause is twofold: the plugin fails to require a shared secret before accepting authorized requests, and it fails to properly sanitise and escape a parameter used in an SQL statement. ...
PT-2026-110052
Name of the Vulnerable Software and Affected Versions Social Web Suite versions prior to 4.1.13 Description The Social Web Suite WordPress plugin fails to require a shared secret before accepting authorized requests. Additionally, it does not sanitize or escape a parameter used in an SQL statemen...
CVE-2026-88930: Improper Neutralization of Special Elements used in an SQL Command
The Social Web Suite WordPress plugin through 4.1.12 does not require its shared secret to be set before accepting requests authorised by it, and does not sanitise and escape a parameter before using it in an SQL statement, allowing unauthenticated users to perform SQL injection attacks...
CVE-2026-88931
The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...
CVE-2026-88931
The Social Web Suite WordPress plugin (versions through 4.1.12 ) is vulnerable to an unauthenticated arbitrary plugin settings update . The root cause is a failure to restrict which settings can be modified via an unauthenticated endpoint. This allows an attacker to overwrite arbitrary plugin opt...
WordPress Social Web Suite plugin <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update vulnerability
Unauthenticated Arbitrary Plugin Settings Update vulnerability discovered by Naoki Kawahigashi in WordPress Plugin Social Web Suite versions = 4.1.12...
EUVD-2026-95504
The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...
CVE-2026-88931 Social Web Suite <= 4.1.12 - Unauthenticated Arbitrary Plugin Settings Update
The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...
PT-2026-108745
Name of the Vulnerable Software and Affected Versions The Social Web Suite WordPress plugin versions prior to 4.1.13 Description The plugin fails to restrict which settings can be modified via an unauthenticated endpoint. This allows an attacker to overwrite arbitrary options, including the share...
CVE-2026-88931: Missing Authorization
The Social Web Suite WordPress plugin through 4.1.12 does not restrict which of its settings may be written through an unauthenticated endpoint, allowing attackers to overwrite arbitrary Social Web Suite WordPress plugin through 4.1.12 options, including the shared secret that guards its own...
CERTFR-2026-ALE-006
creationtimestamp| type| source ---|---|--- 2026-07-15 14:21:07+00:00| seen| https://social.numerique.gouv.fr/users/certfr/statuses/116924433303774121...
at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-security (1.1.4.release) +178 more potentially affected by CVE-2026-41846 via org.springframework:spring-webmvc (4.1.8.release)
org.springframework:spring-webmvc MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release -...
at.molindo.social:spring-social-config (1.1.0.release), at.molindo.social:spring-social-core (1.1.0.release) +310 more potentially affected by CVE-2026-41852 via org.springframework:spring-expression (4.0.3.release)
org.springframework:spring-expression MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-expression and may be impacted: - at.molindo.social:spring-social-config 1.1.0.release -...
at.molindo.social:spring-social-config (1.1.4.release), at.molindo.social:spring-social-security (1.1.4.release) +178 more potentially affected by CVE-2026-22745 via org.springframework:spring-webmvc (4.1.8.release)
org.springframework:spring-webmvc MAVEN version 4.1.8.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.molindo.social:spring-social-config 1.1.4.release -...
at.molindo.social:spring-social-config (1.1.0.release), at.molindo.social:spring-social-security (1.1.0.release) +134 more potentially affected by CVE-2026-22741 via org.springframework:spring-webmvc (4.0.3.release)
org.springframework:spring-webmvc MAVEN version 4.0.3.release is affected by a known vulnerability. The following packages have a transitive dependency on org.springframework:spring-webmvc and may be impacted: - at.molindo.social:spring-social-config 1.1.0.release -...