Discy < 5.0 - Subscriber+ Broken Access Control to change settings

The theme lacks authorization checks then processing ajax requests to the discyupdateoptions action, allowing any logged in users with privileges as low as Subscriber, to change the theme options by sending a crafted POST request. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Type:...

Discy < 5.0 - Subscriber+ Broken Access Control to change settings

The theme lacks authorization checks then processing ajax requests to the discyupdateoptions action, allowing any logged in users with privileges as low as Subscriber, to change the theme options by sending a crafted POST request. POST /wp-admin/admin-ajax.php HTTP/1.1 Content-Type:...

SAMSUNG Mobile devices ImsCore 日志信息泄露漏洞

Samsung ImsCore is a configuration of Samsung Samsung mobile devices.An information disclosure vulnerability exists in Samsung ImsCore, which stems from the failure to protect sensitive information in ImsServiceSwitchBase. An attacker could exploit the vulnerability to obtain IMSI via device logs...

YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak

The plugin does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them PoC Install the plugin and configure any mailer other than Default. Access the wp-admin area with a Subscriber+ use...

YaySMTP < 2.2.1 - Subscriber+ SMTP Credentials Leak

The plugin does not have capability check before displaying the Mailer Credentials in JS code for the settings, allowing any authenticated users, such as subscriber to retrieve them Install the plugin and configure any mailer other than Default. Access the wp-admin area with a Subscriber+ user an...

YaySMTP < 2.2.1 - Subscriber+ Logs Disclosure

The plugin does not have capability check in an AJAX action, allowing any logged in users, such as subscriber to view the Logs of the plugin PoC @author : 0xshdax Rafshanzani Suhada @usage : python3 script.py http://localhost import requests, sys, re, json Setup here url = sys.argv1 headers =...

WordPress plugin Mail Subscribe List 跨站请求伪造漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. cross-site request forgery vulnerability exists in versions of the WordPress Mail Subscribe List plugin...

CVE-2022-29442

Authenticated subscriber or higher user role Stored Cross-Site Scripting XSS vulnerability in Messages For WordPress = 2.1.10 at WordPress...

CVE-2022-1658

Vulnerable versions of the Jupiter Theme = 6.10.1 allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abbremoveplugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, an...

Design/Logic Flaw

Vulnerable versions of the Jupiter Theme = 6.10.1 allow arbitrary plugin deletion by any authenticated user, including users with the subscriber role, via the abbremoveplugin AJAX action registered in the framework/admin/control-panel/logic/plugin-management.php file. Using this functionality, an...

Social Share Buttons < 2.2.4 - Subscriber+ SQLi

The plugin does not properly sanitise and escape some parameters before using them in SQL statements available to any authenticated users, leading to SQL injections...

CVE-2022-0779

The User Meta WordPress plugin before 2.4.4 does not validate the filepath parameter of its umshowuploadedfile AJAX action, which could allow low privileged users such as subscriber to enumerate the local files on the web server via path traversal payloads...

Samsung mobile 日志信息泄露漏洞

Samsung Find My Mobile is an application to find a cell phone by the South Korean company Samsung Samsung. An information disclosure vulnerability exists in SimChangeAlertManger, a version prior to Samsung Find My Mobile 7.2.24.12. A local attacker with log access could exploit the vulnerability ...

Samsung mobile 日志信息泄露漏洞

Samsung Find My Mobile is an application to find a cell phone by the South Korean company Samsung Samsung. An information disclosure vulnerability exists in Samsung Find My Mobile prior to version 7.2.24.12, FmmExtraOperation. A local attacker with log access could exploit the vulnerability to...

Samsung mobile 安全漏洞

Samsung mobile is a cell phone from Samsung, South Korea. Samsung mobile low-battery dumpstate log is vulnerable to information disclosure due to a lack of protection of sensitive information in the low-battery dumpstate log. A local attacker could use this vulnerability to obtain SIM card...

Ultimate Member < 2.4.0 - Subscriber+ Stored Cross-Site Scripting

The plugin does not sanitise and escape the Biography available on user profile pages, which could allow users to perform Cross-Site Scripting attacks via their profile...

HTML2WP <= 1.0.0 - Subscriber+ Arbitrary File Deletion

The plugin does not have authorisation and CSRF checks in an AJAX action, available to any authenticated users such as subscriber, which could allow them to delete arbitrary file To delete the license.txt at the root of the blog: await...

WordPress User Meta Manager plugin path traversal vulnerability

WordPress and WordPress plugin are both products of the WordPress Foundation. WordPress is a blogging platform developed using the PHP language. The WordPress plugin is an application plugin. A path traversal vulnerability exists in versions of the WordPress User Meta Manager plugin prior to...

Exploit for SQL Injection in Duplicate_Post_Project Duplicate_Post

It is an offensive tool for Windows. The repository contains a P...

Plausible Analytics < 1.2.4 - Subscriber+ Arbitrary Settings Update

The plugin has a flawed logic when checking for authorisation and CSRF before updating its settings, allowing any authenticated users, such as subscriber, to update the plugin's settings. The attack is also possible via CSRF against any authenticated user. POST /wp-admin/admin-ajax.php HTTP/1.1...