WordPress Visitor Statistics (Real Time Traffic) <4.8 -SQL Injection

WordPress Visitor Statistics Real Time Traffic plugin before 4.8 does not properly sanitize and escape the refUrl in the refDetails AJAX action, which is available to any authenticated user. This could allow users with a role as low as subscriber to perform SQL injection attacks. id: CVE-2021-247...

WP Visitor Statistics (Real Time Traffic) < 6.9 - SQL Injection

The plugin does not escape user input which is concatenated to an SQL query, allowing unauthenticated visitors to conduct SQL Injection attacks. id: CVE-2023-0600 info: name: WP Visitor Statistics Real Time Traffic 6.9 - SQL Injection author: r3Y3r53,j4vaovo severity: critical description: | The...

Company Visitor Management System 1.0 - SQL Injection

Company Visitor Management System 1.0 contains a SQL injection vulnerability via the login page in the username parameter. An attacker can possibly obtain sensitive information from a database, modify data, and execute unauthorized administrative operations in the context of the affected site. id...

CVE-2023-6000-POC

Detalles Generales CVE-ID : CVE-2023-6000 Puntuación CVSS : 6.1 Tipo : XSS Almacenado Versión corregida : Popup Builder 4.2.3 Esta vulnerabilidad permite a un atacante explotar una falla de Cross-Site Scripting XSS en el plugin Popup Builder de WordPress. El plugin no impide que los visitantes...

CVE-2024-34226

Sistema de Gestión de Visitantes 1.0 Remitente: Kha Do Vulnerabilidad Inyección SQL Descripción Vulnerabilidad de inyección SQL en /php-sqlite-vms/?page=managevisitor&id=1 en SourceCodester Visitor Management System 1.0 permite a los atacantes ejecutar comandos SQL arbitrarios a través del...

CVE-2024-25202

CVE-2024-25202 Se encontró una vulnerabilidad en PHPgurukul visitor management system 1.0. Ha sido clasificada como problemática. El problema afecta una funcionalidad desconocida de la barra de búsqueda que llama a search-result.php y search-visitor.php. La vulnerabilidad es Cross-Site-Scripting...

EUVD-2026-76805

The WPBot WordPress plugin before 8.6.0 does not perform any capability or nonce check on the AJAX action that lists stored chat sessions, allowing unauthenticated attackers to retrieve the name, email address and phone number of every chat visitor by requesting a wide date range...

CVE-2025-15695

The Translate WordPress with GTranslate plugin before 3.0.10 contains a stored cross-site scripting (XSS) vulnerability. One of its settings is not validated before the bundled front-end scripts build markup from it, allowing users with the administrator role or higher to store JavaScript that ex...

CVE-2026-10170-RCE

Visitor Management System 1.0 - SQLi a Ejecución Remota de Código Cadena de Ataque Información de la Vulnerabilidad...

CVE-2023-4357-Chrome-XXE

Introducción de la herramienta El primer EXP del mundo en un solo archivo que explota la vulnerabilidad CVE-2023-4357 Chrome XXE, logrando robar los archivos locales de los visitantes. El primer EXP del mundo en un solo archivo que explota la vulnerabilidad CVE-2023-4357 Chrome XXE, permitiendo a...

CVE-2023-50132

CVE-2023-50132 Descripción sugerida Sourcecodester School Visitor Log e-book v1.0 es vulnerable a Cross Site Scripting XSS. Información adicional enlace de youtube: https://youtu.be/W7Oen8rs64 Tipo de vulnerabilidad Cross Site Scripting XSS Proveedor del producto https://www.sourcecodester.com/...

wordpress-jetpack-broken-access-control-vulnerable-application

wordpress-jetpack-broken-access-control-vulnerable-application This is a vulnerable application to test the exploit for the Jetpack 13.9.1 broken access control CVE-2024-9926. WARNING! This application contains serious security vulnerabilities. Run it at your own risk! It is recommended using a...

CVE-2026-33937

CVE-2026-33937 — RCE por inyección de AST en Handlebars.js Las versiones 4.0.0 a 4.7.8 de Handlebars.js están afectadas. Puntuación CVSS: 9.8 Crítica. Resumen CVE-2026-33937 es una vulnerabilidad de confusión de tipos en Handlebars.js. La función Handlebars.compile acepta tanto una cadena de...

CVE-2026-32479

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-32479 WordPress Visitor Traffic Real Time Statistics Pro plugin <= 11.17 - SQL Injection vulnerability

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

CVE-2026-32479

CVE-2026-32479 is an unauthenticated SQL Injection in the WordPress plugin Visitor Traffic Real Time Statistics Pro , affecting versions ≤ 11.17 . The vulnerability was discovered by Trương Hữu Phúc (Patchstack). The CVSS 3.1 score is 9.3 (Critical) , with a network attack vector, low complexity ...

EUVD-2026-66988

Unauthenticated SQL Injection in Visitor Traffic Real Time Statistics Pro = 11.17 versions...

EUVD-2026-65353

The extension forces empty frontend-group and subpage-inheritance restrictions onto page records during indexer sub-requests, and this forged state was persisted into the shared rootline cache, allowing anonymous visitors to bypass extendToSubpages-inherited access restrictions on cached pages...

CVE-2026-65644

Rocket.Chat in versions before 8.8.0, 8.7.1, 8.6.2, 8.5.3, 8.4.6, 8.3.8, 8.2.8, 8.1.8, and 7.10.15 has a REST API endpoint POST /api/v1/livechat/visitor that accepts an unauthenticated, unsanitized name field for Livechat visitors. This name is stored raw and later rendered via...

CVE-2026-65644

Rocket.Chat versions before 8.8.0 , 8.7.1 , 8.6.2 , 8.5.3 , 8.4.6 , 8.3.8 , 8.2.8 , 8.1.8 , and 7.10.15 contain a stored HTML injection (CWE-79) in the Livechat visitor flow. The unauthenticated REST endpoint POST /api/v1/livechat/visitor accepts an unsanitized name field that is stored raw and l...