CVE-2024-0405 Burst Statistics Really Simple Plugins <= 1.5.3 - Authenticated (Editor+) SQL Injection

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin, version 1.5.3, is vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in the /wp-json/burst/v1/data/compare endpoint. Affected parameters include 'browser', 'device', 'pageid', 'pageurl', 'platform', a...

CVE-2024-0405

The CVE-2024-0405 entry concerns Burst Statistics – Privacy-Friendly Analytics for WordPress (plugin), version 1.5.3, vulnerable to Post-Authenticated SQL Injection via multiple JSON parameters in /wp-json/burst/v1/data/compare (parameters include browser, device, page_id, page_url, platform, ref...

WordPress Burst Statistics Plugin <= 1.5.3 is vulnerable to SQL Injection

Software Burst Statistics Type Plugin Vulnerable versions = 1.5.3 Fixed in 1.5.4 OWASP Top 10 A1: Injection Classification SQL Injection CVE CVE-2024-0405 Patch priority Low CVSS severity Low 7.6 Developer Claim ownership PSID 5b21f7530708 Credits Ivan Spiridonov xbz0n Required privilege Editor...

WordPress Plugin Burst Statistics Security Vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.WordPress plugin is an application plugin. A security vulnerability exists in WordPres...

PT-2024-2679 · Mediawiki +1 · Watchanalytics Extension +2

Name of the Vulnerable Software and Affected Versions: MediaWiki versions prior to 1.40.2 WatchAnalytics extension in MediaWiki affected versions not specified Description: An issue in the WatchAnalytics extension allows for XSS to occur via the Special:PageStatistics page parameter. This can...

Design/Logic Flaw

Nginx-UI is an online statistics for Server Indicators?? Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using DefaultQuery, the "desc" and "id" values are used as default values if the query parameters are not set. Thu...

CVE-2024-22196

CVE-2024-22196 affects nginx-ui (Go) where OrderAndPaginate uses user-controlled query parameters (order and sort_by via DefaultQuery) to build SQL order clauses, enabling SQL injection via crafted requests. Multiple connected sources confirm the vulnerability is exploitable through the GET /api/...

CVE-2024-22196 Authenticated (user role) SQL injection in `OrderAndPaginate` (GHSL-2023-270)

Nginx-UI is an online statistics for Server Indicators​​ Monitor CPU usage, memory usage, load average, and disk usage in real-time. This issue may lead to information disclosure. By using DefaultQuery, the "desc" and "id" values are used as default values if the query parameters are not set. Thu...

Information disclosure

Nginx-ui is online statistics for Server Indicators?? Monitor CPU usage, memory usage, load average, and disk usage in real-time. The Home Preference page exposes a small list of nginx settings such as Nginx Access Log Path and Nginx Error Log Path. However, the API also exposes testconfigcmd,...

CVE-2023-7189

A vulnerability classified as critical was found in S-CMS up to 2.0build20220529-20231006. Affected by this vulnerability is an unknown functionality of the file /s/index.php?action=statistics. The manipulation of the argument lid leads to sql injection. The exploit has been disclosed to the publ...

S-CMS SQL Injection Vulnerability

S-CMS is a PHP and MySQL based Content Management System CMS from S-CMS, China. A SQL injection vulnerability exists in S-CMS version 2.0build20220529-20231006 and earlier versions, which originates from a problem with an unknown function in /s/index.php?action=statistics...

PT-2023-32933 · S Cms · S-Cms

Name of the Vulnerable Software and Affected Versions: S-CMS versions up to 2.0 build20220529-20231006 Description: A critical vulnerability was found in S-CMS, affecting an unknown functionality of the file /s/index.php?action=statistics. The manipulation of the lid argument leads to SQL...

WordPress Burst Statistics - Privacy-Friendly Analytics for WordPress Plugin 1.4.x < 1.5.0 SQLi Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:burst-statistics:burststatistics"; if description...

What to do if your company was mentioned on Darknet?

Every year is abundant with major data leaks, biggest data breaches and hacks drawing massive media attention such as Medibank and Optus data breach, Twitter data breach, and Uber and Rockstar compromise in 2022 and in T-Mobile, MailChimp and OpenAI in 2023. But are we really conscious of the tru...

PT-2023-9843 · Qualcomm · Qualcomm Embedded Platform

Name of the Vulnerable Software and Affected Versions: Qualcomm embedded platform software affected versions not specified Description: The issue is related to a memory corruption vulnerability in the Network Stack module of Qualcomm's embedded platform software. This occurs when processing IPA...

Burst Statistics (Free < 1.5.0, Pro < 1.5.1) - Unauthenticated SQL Injection

Description The plugins do not properly sanitise and escape the url parameter before using it in a SQL statement, leading to an SQL injection exploitable by any authenticated users, such as subscribers curl 'https://example.com/burst-statistics-endpoint.php' \ -H 'content-type:...

CVE-2023-5761

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 free and versions 1.4.0 to 1.5.0 pro due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2023-5761

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 free and versions 1.4.0 to 1.5.0 pro due to insufficient escaping on the user supplied parameter and lack of sufficient...

Sql injection

The Burst Statistics – Privacy-Friendly Analytics for WordPress plugin for WordPress is vulnerable to SQL Injection via the 'url' parameter in versions 1.4.0 to 1.4.6.1 free and versions 1.4.0 to 1.5.0 pro due to insufficient escaping on the user supplied parameter and lack of sufficient...

CVE-2023-5761

CVE-2023-5761 : Burst Statistics – Privacy-Friendly Analytics for WordPress is vulnerable to unauthenticated SQL Injection via the url parameter in versions 1.4.0 to 1.4.6.1 (free) and 1.4.0 to 1.5.0 (pro) due to insufficient escaping and insufficient preparation of the SQL query. Technical detai...