39 matches found
CVE-2024-44004
CVE-2024-44004 affects WP cargo Track & Trace (WordPress) plugin versions up to and including 7.0.6. The vulnerability is an unauthenticated SQL Injection caused by improper neutralization of input in WPCargo Track & Trace, leading to potential remote database manipulation. Public disclosures in ...
WordPress WPCargo Track & Trace Plugin <= 7.0.6 is vulnerable to SQL Injection
Software WPCargo Track & Trace Type Plugin Vulnerable versions = 7.0.6 Fixed in N/A OWASP Top 10 A3: Injection Classification SQL Injection CVE CVE-2024-44004 Patch priority High CVSS severity High 9.3 Developer Claim ownership PSID 8e07b930efd1 Credits LVT-tholv2k Required privilege...
CVE-2022-1436
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargotrackingnumber parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks...
CVE-2022-1435
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
Cross site scripting
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargotrackingnumber parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks...
Cross site scripting
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2022-1436
The CVE-2022-1436 entry refers to the WPCargo Track & Trace WordPress plugin prior to version 6.9.5. The vulnerability is a reflected Cross-Site Scripting (XSS) flaw caused by the plugin not sanitising and escaping the wpcargo_tracking_number parameter before outputting it back in the page. This ...
CVE-2022-1436 WPCargo Track & Trace < 6.9.5 - Reflected Cross Site Scripting
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitise and escape the wpcargotrackingnumber parameter before outputting it back in the page, which could allow attackers to perform reflected Cross-Site Scripting attacks...
CVE-2022-1435 WPCargo Track & Trace < 6.9.5 - Admin+ Stored Cross Site Scripting
The WPCargo Track & Trace WordPress plugin before 6.9.5 does not sanitize and escapes some of its settings, which could allow high privilege users such as admin to perform Cross-Site Scripting attacks even when unfilteredhtml is disallowed...
CVE-2022-1435
CVE-2022-1435 affects the WordPress WPCargo Track & Trace plugin prior to 6.9.5. The vulnerability arises from insufficient sanitization/escaping of certain plugin settings, which could allow an authenticated high-privilege user (e.g., admin) to perform Cross-Site Scripting (XSS) attacks even whe...
WordPress WPCargo Track & Trace plugin <= 6.9.4 - Reflected Cross-Site Scripting (XSS) vulnerability
Reflected Cross-Site Scripting XSS vulnerability discovered by Raul in WordPress WPCargo Track & Trace plugin versions = 6.9.4. Solution Update the WordPress WPCargo Track & Trace plugin to the latest available version at least 6.9.5...
WordPress WPCargo Track & Trace plugin <= 6.9.4 - Authenticated Stored Cross-Site Scripting (XSS) vulnerability
Authenticated Stored Cross-Site Scripting XSS vulnerability discovered by Raul in WordPress WPCargo Track & Trace plugin versions = 6.9.4. Solution Update the WordPress WPCargo Track & Trace plugin to the latest available version at least 6.9.5...
CVE-2021-25003
The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE...
Design/Logic Flaw
The WPCargo Track & Trace WordPress plugin before 6.9.0 contains a file which could allow unauthenticated attackers to write a PHP file anywhere on the web server, leading to RCE...
CVE-2021-25003
The CVE-2021-25003 vulnerability affects WordPress WPCargo Track & Trace plugin prior to version 6.9.0. A crafted file in the plugin can allow an unauthenticated attacker to write a PHP file anywhere on the web server, enabling remote code execution (RCE). The issue is documented as unauthenticat...
CVE-2021-35233 HTTP TRACK & TRACE Methods Enabled
The HTTP TRACK & TRACE methods were enabled in Kiwi Syslog Server 9.7.1 and earlier. These methods are intended for diagnostic purposes only. If enabled, the web server will respond to requests that use these methods by returning exact HTTP request that was received in the response to the client...
Solarwinds Kiwi Syslog Server 配置错误漏洞
Solarwinds Kiwi Syslog Server is an affordable Syslog management tool for network and system engineers from Solarwinds USA. It is used to receive syslog messages and Snmp traps from network devices routers, switches, firewalls, etc. and Linux®/Unix® hosts. A security vulnerability exists in...
kadocus.nl XSS vulnerability
Open Bug Bounty ID: OBB-655731 Description| Value ---|--- Affected Website:| kadocus.nl Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...