CVE-2024-7135

CVE-2024-7135 WordPress용 Tainacan 플러그인은 0.21.7 이하의 모든 버전에서 'getfile' 함수에 대한 누락된 권한 검사로 인해 데이터 무단 접근에 취약합니다. 이 함수는 또한 디렉터리 트래버설directory traversal에도 취약합니다. 이를 통해 Subscriber구독자 수준 이상의 접근 권한을 가진 인증된 공격자가 서버에 있는 임의의 파일 내용을 읽을 수 있으며, 해당 파일에는 민감한 정보가 포함될 수 있습니다. 사용법 root@kitploit: WordPress CVE-2024-71...

CVE-2024-3867

CVE-2024-3867 이 저장소는 제가 발견한 이 취약점에 대한 몇 가지 정보를 보여줍니다. 다음은 제공된 공식 설명입니다: WordPress용 archive-tainacan-collection 테마는 버전 2.7.2에서 URL에 적절한 이스케이프 처리 없이 addqueryarg를 사용하기 때문에 반사형 크로스 사이트 스크립팅에 취약합니다. 이로 인해 인증되지 않은 공격자가 페이지에 임의의 웹 스크립트를 주입할 수 있으며, 사용자가 링크 클릭과 같은 동작을 수행하도록 속이는 데 성공하면 스크립트가 실행됩니다. 기본적으로 이...

CVE-2024-7135

CVE-2024-7135 Tainacan = 0.21.7 - 인증된 사용자구독자 이상의 임의 파일 읽기를 허용하는 인증 누락 설명 WordPress용 Tainacan 플러그인은 0.21.7 이하 모든 버전에서 'getfile' 함수에 대한 기능 검사capability check 누락으로 인해 데이터에 대한 무단 접근에 취약합니다. 이 함수는 디렉터리 트래버설directory traversal에도 취약합니다. 이로 인해 구독자Subscriber 수준 이상의 권한을 가진 인증된 공격자가 서버에 있는 임의 파일의 내용을 읽을 수 있...

CVE-2026-6230

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-6230 Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-6230 Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-6230

The CVE-2026-6230 entry concerns the Tainacan WordPress plugin vulnerable to a time-based blind SQL Injection via the REST API parameter 'geoquery' in all versions up to 1.0.3. Root cause is insufficient escaping of the user-supplied parameter and inadequate preparation of the existing SQL query,...

CVE-2026-6230 Tainacan <= 1.0.3 - Unauthenticated SQL Injection via 'geoquery' REST API Parameter

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-6230

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

EUVD-2026-42215

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

PT-2026-56402

The Tainacan plugin for WordPress is vulnerable to time-based blind SQL Injection via the 'geoquery' parameter in all versions up to and including 1.0.3 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible...

CVE-2026-42740

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through = 1.0.3...

WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability

SQL Injection vulnerability discovered by hhhai in WordPress Plugin Tainacan versions = 1.0.3...

CVE-2026-42740

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through = 1.0.3...

CVE-2026-42740 WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through = 1.0.3...

CVE-2026-42740 WordPress Tainacan plugin <= 1.0.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through = 1.0.3...

EUVD-2026-32192

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through = 1.0.3...

CVE-2026-42740

The connected sources confirm a SQL Injection vulnerability in the WordPress Tainacan plugin, affecting version range

CVE-2026-42740

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through = 1.0.3...

PT-2026-43652

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in tainacan Tainacan tainacan allows Blind SQL Injection.This issue affects Tainacan: from n/a through = 1.0.3...