• 设为首页
  • 点击收藏
  • 手机版
    手机扫一扫访问
    迪恩网络手机版
  • 关注官方公众号
    微信扫一扫关注
    公众号
登陆 注册
OStack程序员社区-中国程序员成长平台 › 门户 › 漏洞›CVE漏洞

CVE漏洞

RSS
  • CVE-2021-24823
    CVE-2021-24823
    The Support Board WordPress plugin before 3.3.6 does not have any CSRF checks in actions handled by the include/ajax.php file, which could allow attackers to make logged in users do unwanted actions. ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：38 | 回复：0
  • CVE-2021-24864
    CVE-2021-24864
    The WP Cloudy, weather plugin WordPress plugin before 4.4.9 does not escape the post_id parameter before using it in a SQL statement in the admin dashboard, leading to a SQL Injection issue……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：33 | 回复：0
  • CVE-2021-24898
    CVE-2021-24898
    The EditableTable WordPress plugin through 0.1.4 does not sanitise and escape any of the Table and Column fields, which could allow high privilege users to perform Cross-Site Scripting attacks even wh ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：51 | 回复：0
  • CVE-2021-24901
    CVE-2021-24901
    The Security Audit WordPress plugin through 1.0.0 does not sanitise and escape the Data Id setting, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfilte ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：65 | 回复：0
  • CVE-2021-24903
    CVE-2021-24903
    The GRAND FlaGallery WordPress plugin through 6.1.2 does not sanitise and escape some of its gallery settings, which could allow high privilege users to perform Cross-Site scripting attacks even when ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：74 | 回复：0
  • CVE-2021-24913
    CVE-2021-24913
    The Logo Showcase with Slick Slider WordPress plugin before 2.0.1 does not have CSRF check in the lswss_save_attachment_data AJAX action, allowing attackers to make a logged in high privilege user, ch ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：93 | 回复：0
  • CVE-2021-24920
    CVE-2021-24920
    The StatCounter WordPress plugin before 2.0.7 does not sanitise and escape the Project ID and Secure Code settings, which could allow high privilege users to perform Cross-Site Scripting attacks even ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：209 | 回复：0
  • CVE-2021-24933
    CVE-2021-24933
    The Dynamic Widgets WordPress plugin through 1.5.16 does not escape the prefix parameter before outputting it back in an attribute when using the term_tree AJAX action (available to any authenticated ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：124 | 回复：0
  • CVE-2021-24971
    CVE-2021-24971
    The WP Responsive Menu WordPress plugin before 3.1.7.1 does not have capability and CSRF checks in the wpr_live_update AJAX action, as well as do not sanitise and escape some of the data submitted. As ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：96 | 回复：0
  • CVE-2021-24977
    CVE-2021-24977
    The Use Any Font | Custom Font Uploader WordPress plugin before 6.2.1 does not have any authorisation checks when assigning a font, allowing unauthenticated users to sent arbitrary CSS which will then ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：88 | 回复：0
  • CVE-2021-24994
    CVE-2021-24994
    The Migration, Backup, Staging WordPress plugin before 0.9.69 does not have authorisation when adding remote storages, and does not sanitise as well as escape a parameter from such unauthenticated req ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：68 | 回复：0
  • CVE-2021-25010
    CVE-2021-25010
    The Post Snippets WordPress plugin before 3.1.4 does not have CSRF check when importing files, allowing attacker to make a logged In admin import arbitrary snippets. Furthermore, imported snippers are ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：68 | 回复：0
  • CVE-2021-25011
    CVE-2021-25011
    The Maps Plugin using Google Maps for WordPress plugin before 1.8.1 does not have proper authorisation and CSRF in most of its AJAX actions, which could allow any authenticated users, such as subscrib ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：75 | 回复：0
  • CVE-2021-25034
    CVE-2021-25034
    The WP User WordPress plugin before 7.0 does not sanitise and escape some parameters in pages where the shortcode is used, leading to Reflected Cross-Site Scripting issues……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：105 | 回复：0
  • CVE-2021-25042
    CVE-2021-25042
    The WP Visitor Statistics (Real Time Traffic) WordPress plugin before 5.5 does not have authorisation and CSRF checks in the updateIpAddress AJAX action, allowing any authenticated user to call it, or ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：65 | 回复：0
  • CVE-2021-25081
    CVE-2021-25081
    The Maps Plugin using Google Maps for WordPress plugin before 1.8.4 does not have CSRF checks in most of its AJAX actions, which could allow attackers to make logged in admins delete arbitrary posts a ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：84 | 回复：0
  • CVE-2021-25112
    CVE-2021-25112
    The WHMCS Bridge WordPress plugin before 6.4b does not sanitise and escape the error parameter before outputting it back in admin dashboard, leading to a Reflected Cross-Site Scripting……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：67 | 回复：0
  • CVE-2021-25118
    CVE-2021-25118
    The Yoast SEO WordPress plugin before 17.3 discloses the full internal path of featured images in posts via the wp/v2/posts REST endpoints which could help an attacker identify other vulnerabilities o ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：82 | 回复：0
  • CVE-2021-4222
    CVE-2021-4222
    The WP-Paginate WordPress plugin before 2.1.4 does not sanitise and escape its preset settings, allowing high privilege users such as admin to perform Cross-Site Scripting attacks even when the unfilt ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：71 | 回复：0
  • CVE-2022-0150
    CVE-2022-0150
    The WP Accessibility Helper (WAH) WordPress plugin before 0.6.0.7 does not sanitise and escape the wahi parameter before outputting back its base64 decode value in the page, leading to a Reflected Cro ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：74 | 回复：0
  • CVE-2022-0189
    CVE-2022-0189
    The WP RSS Aggregator WordPress plugin before 4.20 does not sanitise and escape the id parameter in the wprss_fetch_items_row_action AJAX action before outputting it back in the response, leading to a ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：52 | 回复：0
  • CVE-2022-0328
    CVE-2022-0328
    The Simple Membership WordPress plugin before 4.0.9 does not have CSRF check when deleting members in bulk, which could allow attackers to make a logged in admin delete them via a CSRF attack……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：63 | 回复：0
  • CVE-2022-0345
    CVE-2022-0345
    The Customize WordPress Emails and Alerts WordPress plugin before 1.8.7 does not have authorisation and CSRF check in its bnfw_search_users AJAX action, allowing any authenticated users to call it and ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：61 | 回复：0
  • CVE-2022-0360
    CVE-2022-0360
    The Easy Drag And drop All Import : WP Ultimate CSV Importer WordPress plugin before 6.4.3 does not sanitise and escaped imported comments, which could allow high privilege users to import malicious o ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：65 | 回复：0
  • CVE-2022-0377
    CVE-2022-0377
    Users of the LearnPress WordPress plugin before 4.1.5 can upload an image as a profile avatar after the registration. After this process the user crops and saves the image. Then a POST request that co ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：66 | 回复：0
  • CVE-2022-0383
    CVE-2022-0383
    The WP Review Slider WordPress plugin before 11.0 does not sanitise and escape the pid parameter when copying a Twitter source, which could allow a high privilege users to perform SQL Injections attac ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：60 | 回复：0
  • CVE-2022-0385
    CVE-2022-0385
    The Crazy Bone WordPress plugin through 0.6.0 does not sanitise and escape the username submitted via the login from when displaying them back in the log dashboard, leading to an unauthenticated Store ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：52 | 回复：0
  • CVE-2022-0411
    CVE-2022-0411
    The Asgaros Forum WordPress plugin before 2.0.0 does not sanitise and escape the post_id parameter before using it in a SQL statement via a REST route of the plugin (accessible to any authenticated us ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：57 | 回复：0
  • CVE-2022-0412
    CVE-2022-0412
    The TI WooCommerce Wishlist WordPress plugin before 1.40.1, TI WooCommerce Wishlist Pro WordPress plugin before 1.40.1 do not sanitise and escape the item_id parameter before using it in a SQL stateme ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：453 | 回复：0
  • CVE-2022-23911
    CVE-2022-23911
    The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not validate and escape the id parameter before using it in a SQL statement when retrieving a testimonial to edit, leading to a SQL ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：67 | 回复：0
  • CVE-2022-23912
    CVE-2022-23912
    The Testimonial WordPress Plugin WordPress plugin before 1.4.7 does not sanitise and escape the id parameter before outputting it back in an attribute, leading to a Reflected cross-Site Scripting……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：65 | 回复：0
  • CVE-2022-23987
    CVE-2022-23987
    The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape their Form Name, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfil ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：52 | 回复：0
  • CVE-2022-23988
    CVE-2022-23988
    The WS Form LITE and Pro WordPress plugins before 1.8.176 do not sanitise and escape submitted form data, allowing unauthenticated attacker to submit XSS payloads which will get executed when a privil ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：77 | 回复：0
  • CVE-2022-0768
    CVE-2022-0768
    Server-Side Request Forgery (SSRF) in GitHub repository rudloff/alltube prior to 3.0.2.……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：61 | 回复：0
  • CVE-2022-24571
    CVE-2022-24571
    Car Driving School Management System v1.0 is affected by SQL injection in the login page. An attacker can use simple SQL login injection payload to get admin access.……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：64 | 回复：0
  • CVE-2022-24572
    CVE-2022-24572
    Car Driving School Management System v1.0 is affected by Cross Site Scripting (XSS) in the User Enrollment Form (Username Field). To exploit this Vulnerability, an admin views the registered user deta ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：73 | 回复：0
  • CVE-2022-24685
    CVE-2022-24685
    HashiCorp Nomad and Nomad Enterprise 1.x before 1.0.17, 1.1.x before 1.1.12, and 1.2.x before 1.2.6 has Uncontrolled Resource Consumption.……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：60 | 回复：0
  • CVE-2021-43086
    CVE-2021-43086
    ARM astcenc 3.2.0 is vulnerable to Buffer Overflow. When the compression function of the astc-encoder project with -cl option was used, a stack-buffer-overflow occurred in function encode_ise() in fun ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：57 | 回复：0
  • CVE-2021-44334
    CVE-2021-44334
    David Brackeen ok-file-formats 97f78ca is vulnerable to Buffer Overflow. When the function of the ok-file-formats project is used, a heap-buffer-overflow occurs in function ok_jpg_convert_YCbCr_to_RGB ...……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：58 | 回复：0
  • CVE-2022-25642
    CVE-2022-25642
    Obyte (formerly Byteball) Wallet before 3.4.1 allows XSS. A crafted chat message can lead to remote code execution.……
    作者：菜鸟教程小白 | 时间：2022-6-23 08:32 | 阅读：175 | 回复：0

关注我们

极客给你想要的成长

关注极客中国获取最新资讯

加入Q群 官方微博
热门推荐
More+
专题导读
More+
热门话题
More+
阅读排行榜

扫描微信二维码

查看手机版网站

随时了解更新最新资讯

139-2527-9053

在线客服（服务时间 9:00～18:00）

在线QQ客服
地址：深圳市南山区西丽大学城创智工业园
电邮：jeky_zhao#qq.com
移动电话：139-2527-9053

Powered by 互联科技 X3.4© 2001-2213 极客世界.|Sitemap