2599 matches found
CVE-2020-5767
CVE-2020-5767 concerns a cross-site request forgery in the WordPress plugin “Email Subscribers & Newsletters” by Icegram, specifically version 4.4.8. The vulnerability allows a remote attacker to cause the affected WordPress user to send forged emails by tricking them into visiting a crafted link...
WordPress Email Subscribers & Newsletters <= 4.5.0.1 - Authenticated SQL injection (SQLi) vulnerability
Authenticated SQL injection SQLi vulnerability found by Tenable in WordPress Email Subscribers & Newsletters versions = 4.5.0.1. Solution Update the WordPress Email Subscribers & Newsletters to the latest available version at least 4.5.1...
PT-2020-18689
Name of the Vulnerable Software and Affected Versions Icegram Email Subscribers & Newsletters Plugin for WordPress version 4.4.8 Description The issue concerns an SQL Injection vulnerability due to improper neutralization of special elements used in an SQL command. This allows a remote,...
CVE-2020-5767: Cross-Site Request Forgery (CSRF)
Cross-site request forgery in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link...
CVE-2020-5768: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' in Icegram Email Subscribers & Newsletters Plugin for WordPress v4.4.8 allows a remote, authenticated attacker to determine the value of database fields...
WordPress Email Subscribers & Newsletters plugin <= 4.5.0.1 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability found by Tenable in WordPress Email Subscribers & Newsletters plugin versions = 4.5.0.1. Solution Update the WordPress Email Subscribers & Newsletters plugin to the latest available version at least 4.5.1...
PT-2020-18688
Name of the Vulnerable Software and Affected Versions Icegram Email Subscribers & Newsletters Plugin for WordPress version 4.4.8 Description The issue allows a remote attacker to send forged emails by tricking legitimate users into clicking a crafted link, due to cross-site request forgery...
Zoom Beefs Up End-to-End Encryption to Thwart 'Zoombombers'
Video calling platform Zoom is boosting its security profile via the acquisition of a small startup called Keybase. The 25-person, New York-based company will provide more robust encryption for Zoom calls on paid subscriptions by implementing an end-to-end architecture. “Logged-in users will...
CVE-2020-12074
The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV...
CVE-2020-12074
The users-customers-import-export-for-wp-woocommerce plugin before 1.3.9 for WordPress allows subscribers to import administrative accounts via CSV...
CVE-2020-12074
The CVE concerns the WordPress plugin “users-customers-import-export-for-wp-woocommerce” (pre-1.3.9). The vulnerability allows subscribers to import new users, including administrative accounts, via a CSV import, enabling privilege escalation within WordPress. Root cause is improper validation/au...
WordPress Email Subscribers Plugin < 4.3.1 Blind SQLi Vulnerability
The WordPress plugin Copyright C 2020 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it...
WordPress Plugin Bug in Popup Builder Threatens 100K Websites
Two vulnerabilities – including a high-severity flaw – have been patched in a popular WordPress plugin called Popup Builder. The more severe flaw could enable an unauthenticated attacker to infect malicious JavaScript into a popup – potentially opening up more than 100,000 websites to takeover...
Chadha PHPKB Cross-Site Scripting Vulnerability (CNVD-2020-17369)
Chadha Software Technologies PHPKB Standard Multi-Language is a web-based, multi-language knowledge base management system from Chadha Software Technologies, India. A reflected cross-site scripting vulnerability exists in admin/manage-subscribers.php in Chadha PHPKB Standard Multi-Language versio...
CVE-2020-10430
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-subscribers.php by adding a question mark ? followed by the payload...
CVE-2020-10430
The way URIs are handled in admin/header.php in Chadha PHPKB Standard Multi-Language 9 allows Reflected XSS injecting arbitrary web script or HTML in admin/manage-subscribers.php by adding a question mark ? followed by the payload...
CVE-2015-7341
JNews Joomla Component before 8.5.0 allows arbitrary File Upload via Subscribers or Templates, as demonstrated by the .php5 extension...
CVE-2015-7342
JNews Joomla Component before 8.5.0 allows SQL injection via upload thumbnail, Queue Search Field, Subscribers Search Field, or Newsletters Search Field...
