406 matches found
CVE-2022-3336 Event Monster < 1.2.0 - Visitors Deletion via CSRF
The Event Monster WordPress plugin before 1.2.0 does not have CSRF check when deleting visitors, which could allow attackers to make logged in admin delete arbitrary visitors via a CSRF attack...
CVE-2022-3336
The Event Monster WordPress plugin (versions prior to 1.2.0) is vulnerable to Cross-Site Request Forgery (CSRF) when deleting visitors due to missing CSRF checks. This could allow a logged-in administrator to delete arbitrary visitors via a CSRF attack. Root cause: lack of CSRF verification in th...
WordPress Event Monster plugin <= 1.1.20 - Cross-Site Request Forgery (CSRF) vulnerability
Cross-Site Request Forgery CSRF vulnerability leading to Visitors Deletion discovered by Thura Moe Myint in the WordPress Event Monster plugin versions = 1.1.20. Solution Update the WordPress Event Management Tickets Booking plugin to the latest available version at least 1.2.0...
WordPress plugin WordPress Visitors 跨站脚本漏洞
WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL.WordPress plugin is an application plugin. WordPress plugin WordPress Visitors...
CVE-2022-2552
The Duplicator WordPress plugin before 1.4.7 does not authenticate or authorize visitors before displaying information about the system such as server software, php version and full file system path to the site...
WooCommerce < 6.6.0 - Admin+ Stored HTML Injection
The plugin is vulnerable to stored HTML injection due to lack of escaping and sanitizing in the payment gateway titles PoC Go to WooCommerce - Settings - Payments tab, enable BAC Bank Account Transfers and edit the title in the setup dialog. HTML can be injected there, and will be rendered both f...
CVE-2021-41418
AriaNg v0.1.0v1.2.2 is affected by an incorrect access control vulnerability through not authenticating visitors' access rights...
Millions of WordPress Sites Got a Forced Update for a Serious Bug
The mandatory patch addressed a critical vulnerability in a widely used plugin that allowed untrusted visitors to download a website's backups...
IP2Location Country Blocker < 2.26.5 - Subscriber+ Arbitrary Country Ban
The plugin does not have authorisation and CSRF checks in the ip2locationcountryblockersaverules AJAX action, allowing any authenticated users, such as subscriber to call it and block arbitrary country, or block all of them at once, preventing users from accessing the frontend. v2.26.5 added...
CVE-2021-37048
There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to fake visitors to control PC,play a video,etc...
Input validation
There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to fake visitors to control PC,play a video,etc...
CVE-2021-37048
There is a Improper Input Validation vulnerability in Huawei Smartphone.Successful exploitation of this vulnerability may lead to fake visitors to control PC,play a video,etc...
GHSA-X7J7-QP7J-HW3Q Cross-site scripting (XSS) from writer field content in the site frontend
Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other field types, it is not possible to escape HTML special characters against cross-site scripting XSS attacks, otherwise the formatting would be lost. Cross-site scripting XSS is a type of vulnerability that...
CVE-2021-39402
MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors...
CVE-2021-39402
MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors...
CVE-2021-39402
MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors...
Code injection
MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors...
CVE-2021-39402
MaianAffiliate v.1.0 is suffers from code injection by adding a new product via the admin panel. The injected payload is reflected on the affiliate main page for all authenticated and unauthenticated visitors...
PHPGurukul Apartment Visitors Management System SQL Injection Vulnerability
PHPGurukul Apartment Visitors Management System is an apartment visitor management system from the PHPGurukul team.A SQL injection vulnerability exists in PHPGurukul Apartment Visitors Management System version 1.0, which could be exploited by attackers to The vulnerability can be exploited to...