CVE-2024-7135

CVE-2024-7135 WordPress用Tainacanプラグインは、0.21.7までの全バージョンにおいて、'getfile'関数に対する権限チェックが欠如しているため、データへの不正アクセスに対して脆弱です。この関数はディレクトリトラバーサルに対しても脆弱です。これにより、Subscriberレベル以上のアクセス権を持つ認証済み攻撃者が、サーバー上の任意のファイルの内容を読み取ることが可能になり、その中には機密情報が含まれる可能性があります。 使い方 WordPress CVE-2024-7135 Wordpress Tainacan 0.21.7 Arbitrary Fil...

CVE-2024-3867

CVE-2024-3867 このリポジトリは、私が発見したこの脆弱性に関する情報を紹介します。 以下は公式の説明です。 WordPress用テーマarchive-tainacan-collectionは、バージョン2.7.2において、URL内のaddqueryargに適切なエスケープを行わずに使用しているため、反映型クロスサイトスクリプティング（Reflected XSS）の脆弱性があります。これにより、認証されていない攻撃者が、ユーザーにリンクをクリックさせるなどの操作を成功させた場合に、任意のWebスクリプトをページに注入できる可能性があります。...

CVE-2024-7135

CVE-2024-7135 Tainacan = 0.21.7 - 인증된 사용자구독자 이상의 임의 파일 읽기를 허용하는 인증 누락 설명 WordPress용 Tainacan 플러그인은 0.21.7 이하 모든 버전에서 'getfile' 함수에 대한 기능 검사capability check 누락으로 인해 데이터에 대한 무단 접근에 취약합니다. 이 함수는 디렉터리 트래버설directory traversal에도 취약합니다. 이로 인해 구독자Subscriber 수준 이상의 권한을 가진 인증된 공격자가 서버에 있는 임의 파일의 내용을 읽을 수 있...

CVE-2026-95590

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

CVE-2026-95590

The Tainacan WordPress plugin (versions

CVE-2026-95590 WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

CVE-2026-95590 WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

EUVD-2026-85500

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

WordPress Tainacan plugin <= 1.2.0 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Trương Hữu Phúc truonghuuphuc in WordPress Plugin Tainacan versions = 1.2.0...

CVE-2026-95590: Improper Neutralization of Special Elements used in an SQL Command

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

PT-2026-97485

Subscriber SQL Injection in Tainacan = 1.2.0 versions...

CVE-2026-6230

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-6230 Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-6230

The CVE-2026-6230 entry concerns the Tainacan WordPress plugin vulnerable to a time-based blind SQL Injection via the REST API parameter 'geoquery' in all versions up to 1.0.3. Root cause is insufficient escaping of the user-supplied parameter and inadequate preparation of the existing SQL query,...

CVE-2026-6230 Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-6230 Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-6230

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

EUVD-2026-42215

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-6230: Improper Neutralization of Special Elements used in an SQL Command

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

PT-2026-56402

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...