CVE-2017-1002004

The CVE-2017-1002004 entry concerns the WordPress DTracker plugin (v1.5) with an SQL injection in dtracker/download.php where user input is not sanitized for the id parameter before appending to SQL queries. Public sources in the Connected documents describe multiple unauthenticated blind SQL inj...

CVE-2017-1002007

CVE-2017-1002007 affects the WordPress DTracker plugin v1.5. The issue is in dtracker/save_mail.php, which does not verify that the user is authorized before inserting new contacts into wp_contact. The root cause is missing authorization checks, allowing an unauthenticated attempt to inject data ...

CVE-2017-1002005

CVE-2017-1002005 affects the WordPress DTracker plugin (v1.5): the delete.php path uses user input for contact_id directly in an SQL query without sanitization, enabling SQL injection. Connected documents corroborate a SQL injection vulnerability in DTracker 1.5, with multiple sources flagging un...

CVE-2017-1002006

Vulnerability in WordPress DTracker plugin v1.5 is caused by dtracker/save_contact.php failing to verify user authorization before inserting contacts into the wp_contact table. The issue enables unauthorized users to inject new contacts, potentially compromising site data. Connected sources corro...