Comments - wpDiscuz 7.0.0 - 7.0.4 - Unauthenticated Arbitrary File Upload

This flaw gave unauthenticated attackers the ability to upload arbitrary files, including PHP files, and achieve remote code execution on a vulnerable site’s server. PoC POST /wp-admin/admin-ajax.php HTTP/1.1 Host: URL Content-Length: 774 Accept: / X-Requested-With: XMLHttpRequest User-Agent:...

WordPress wpDiscuz plugin <= 7.0.4 - Unauthenticated Arbitrary File Upload vulnerability

Unauthenticated Arbitrary File Upload vulnerability found by Chloe Chamberland in WordPress wpDiscuz plugin versions = 7.0.4. Solution Update the WordPress wpDiscuz plugin to the latest available version at least 7.0.5...

WordPress gVectors wpDiscuz Plugin SQL Injection (CVE-2020-13640)

An SQL injection vulnerability exists in WordPress gVectors wpDiscuz Plugin. Successful exploitation of this vulnerability could allow a remote attacker to execute arbitrary SQL commands on the affected system...

WordPress gVectors wpDiscuz plugin SQL Injection Vulnerability

WordPress is a blogging platform from the WordPress Foundation developed using the PHP language. The platform supports personal blog sites on servers running PHP and MySQL. gVectors wpDiscuz is a responsive commenting plugin with real-time discussion functionality that is used in... A SQL injecti...

CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. No 7.x versions are affected...

CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. No 7.x versions are affected...

Sql injection

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. No 7.x versions are affected...

CVE-2020-13640

A SQL injection issue in the gVectors wpDiscuz plugin 5.3.5 and earlier for WordPress allows remote attackers to execute arbitrary SQL commands via the order parameter of a wpdLoadMoreComments request. No 7.x versions are affected...

CVE-2020-13640

The CVE-2020-13640 issue affects the WordPress plugin wpDiscuz (gVectors) versions up to 5.3.5. The vulnerability is a SQL injection in the wpdLoadMoreComments request, exploitable via the order parameter, enabling an attacker to execute arbitrary SQL commands. Impact is unauthenticated remote ex...

PT-2020-13630

Name of the Vulnerable Software and Affected Versions wpDiscuz plugin versions 5.3.5 and earlier Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands via the order parameter of a "wpdLoadMoreComments" request. Recommendations For wpDiscuz plugin versions 5.3...

WordPress wpDiscuz plugin <= 5.3.5 - Unauthenticated SQL Injection (SQLi) vulnerability

Unauthenticated SQL Injection SQLi vulnerability found in WordPress wpDiscuz plugin versions = 5.3.5. Solution Update the WordPress wpDiscuz plugin to the latest available version at least 5.3.6...

wpDiscuz < 5.3.6 - Unauthenticated SQL Injection

The Comments – wpDiscuz WordPress plugin was affected by an Unauthenticated SQL Injection security vulnerability...

WordPress wpDiscuz Unauthenticated File Upload Vulnerability

This module exploits an arbitrary file upload in the WordPress wpDiscuz plugin versions = 7.0.0 and use exploit/unix/webapp/wp/wpdiscuzunauthenticatedfileupload msf undefinedwpdiscuzunauthenticatedfileupload show actions ...actions... msf undefinedwpdiscuzunauthenticatedfileupload set ACTION msf...

WordPress wpDiscuz plugin <= 3.2.8 - Cross-Site Request Forgery (CSRF) Vulnerability

Cross-Site Request Forgery CSRF Vulnerability was found in WordPress wpDiscuz plugin in 3.2.8 version. There's no nonce check when resetting the plugins settings. Solution Update the plugin...

wpDiscuz <= 3.1.4 - Reflected Cross-Site Scripting (XSS)

The Comments – wpDiscuz WordPress plugin was affected by a Reflected Cross-Site Scripting XSS security vulnerability...

WordPress wpDiscuz Plugin <= 3.1.4 - Reflected Cross Site Scripting (XSS)

This plugin is prone to a reflected cross site scripting vulnerability, because "Content-Type: application/json" is not set. Solution Update the plugin...