3918 matches found
Ultimate Membership Pro < 8.6.2 - Multiple CSRF Issues via AJAX Calls, Insufficient Filename Entropy
Version 8.6.1 attempted fo fix multiple critical issues mainly lack of authorisation checks, allowing low privileges users to call the admin functions of the plugin, leading to PII disclosure and login bypasses. However, the fixes were not sufficient: - An indeedIsAdmin check was added to all AJA...
WordPress Ultimate Membership Pro premium plugin <= 8.6.1 - Multiple Cross-Site Scripting (CSRF) vulnerabilities
Multiple Cross-Site Scripting CSRF vulnerabilities discovered ErwanLR in WordPress Ultimate Membership Pro premium plugin versions = 8.6.1. Solution Update the WordPress Ultimate Membership Pro premium plugin to the latest available version at least 8.6.2...
Ultimate Membership Pro < 8.7 - Cross-Site Request Forgery allowing Arbitrary Account Deletion and Creation
While confirming the issues from https://wpvulndb.com/vulnerabilities/10086 have been remediated, two CSRF issues were identified, allowing attackers to make logged in administrator delete arbitrary accounts, as well as create a new administrator account. Other CSRF may be present but haven't bee...
WordPress Ultimate-Member 2.1.3 Local File Inclusion
Title : WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion - Author : mehran feizi - Category : Webapps - Date : 2020-02-11 - vendor home page: https://wordpress.org/plugins/ultimate-member/ Vulnerable Page: /class-admin-upgrade.php Vulnerable Source: 354: ifempty$POST'pack' else 356:...
WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion
Title : WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion Author : mehran feizi Vendor : https://wordpress.org/plugins/ultimate-member/ Category : Webapps Date : 2020-02-11 Vendor home page: https://wordpress.org/plugins/ultimate-member/ Vulnerable Page: /class-admin-upgrade.php...
WordPress ultimate-member 2.1.3 Plugin - Local File Inclusion Vulnerability
Exploit for php platform in category web applications Title : WordPress Plugin ultimate-member 2.1.3 - Local File Inclusion Author : mehran feizi Vendor : https://wordpress.org/plugins/ultimate-member/ Category : Webapps Vendor home page: https://wordpress.org/plugins/ultimate-member/ Vulnerable...
CVE-2014-3860
Xilisoft Video Converter Ultimate 7.8.1 build-20140505 has a DLL Hijacking vulnerability...
Ultimate Membership Pro < 8.6.1 - Multiple Critical Vulnerabilities
Multiple Critical Vulnerabilities found in Ultimate Membership Pro could leads to Authenticated using a low privilege account, such as subscriber Remote Code Execution on default Installation, as well as PII disclosure such as emails, IP addresses, hashed passwords, usernames, User-Agent and so o...
Ultimate Membership Pro plugin <= 8.6 - Multiple Critical Vulnerabilities
Multiple Critical Vulnerabilities found by Noman Riffat in Ultimate Membership Pro plugin versions = 8.6. Solution Update the Ultimate Membership Pro plugin to the latest available version at least 8.6.1...
School ERP System 1.0 - Cross Site Request Forgery (Add Admin)
School ERP System 1.0 - Cross Site Request Forgery Add Admin Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link:...
School ERP System 1.0 - Cross Site Request Forgery (Add Admin)
Title: School ERP System 1.0 - Cross Site Request Forgery Add Admin Date: 2020-01-31 Exploit Author: J3rryBl4nks Vendor Homepage: https://sourceforge.net/projects/school-erp-ultimate/files/ Software Link: https://sourceforge.net/projects/school-erp-ultimate/files/ Version ERP-Ultimate CVE:...
200K WordPress Sites Vulnerable to Plugin Flaw
A high-severity vulnerability exists in a popular WordPress plugin, potentially opening up 200,000 websites to takeover. The WordPress plugin in question in Code Snippets, which allows users to run small chunks of PHP code on their websites. This can be used to extend the functionality of the...
WordPress Ultimate Addons for Beaver Builder <= 1.24.3 - Cross-Site Scripting (XSS) vulnerability
Cross-Site Scripting XSS vulnerability discovered in WordPress Ultimate Addons for Beaver Builder versions = 1.24.3. Solution Update the WordPress Ultimate Addons for Beaver Builder to the latest available version at least 1.25.0...
WordPress Ultimate Member plugin <= 2.1.2 - Insecure Direct Object Reference (IDOR) vulnerability
Insecure Direct Object Reference IDOR vulnerability found in WordPress Ultimate Member plugin versions = 2.1.2. Solution Update the WordPress Ultimate Member plugin to the latest available version at least 2.1.3...
WordPress Ultimate Member Plugin <= 2.1.2 Multiple Insecure Direct Object Reference Vulnerabilities
The WordPress plugin Copyright C 2020 Greenbone Networks GmbH SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you can redistribute it and/or modify it under the terms of the GNU General Public License as published by the Free Software Foundation; either version 2 of the...
WordPress Ultimate FAQ Cross-Site Scripting Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Ultimate FAQ is a FAQ plugin used in it. A cross-site scripting vulnerability exists in WordPress Ultimate FAQ versions prior to 1.8.30...
CVE-2020-7107
The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via DisplayFAQ to Shortcodes/DisplayFAQs.php...
CVE-2020-7107
The Ultimate FAQ plugin before 1.8.30 for WordPress allows XSS via DisplayFAQ to Shortcodes/DisplayFAQs.php...
