Base de CVEs

The click5 CRM add-on to WPForms WordPress plugin through 1.0.3 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to WPForms WordPress plugin through 1.0.3. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

The click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1 does not have authorisation and CSRF checks when updating options via a REST endpoint, and does not ensure that the option to be updated belongs to the click5 CRM add-on to Ninja Forms WordPress plugin through 1.0.1. As a result, unauthenticated attackers could change arbitrary blog options, allowing them to create a new administrator account and take over the site.

The Fundiin cho WooCommerce WordPress plugin through 3.4.0 does not have proper authorisation on several of its REST API routes, relying instead on a credential that is identical on every installation, allowing unauthenticated attackers to disclose the store's payment credentials and customer order data, overwrite the payment gateway configuration so that payments are credited elsewhere, and mark unpaid orders as paid. The same missing authorisation also allows arbitrary script to be stored in a field which is output unescaped on the classic checkout, leading to unauthenticated stored XSS on stores that do not use the block-based checkout.

A flaw has been found in OpenSpug Spug up to 3.4.0/4.0.1. This impacts an unknown function of the file /exec/transfer of the component File Transfer. Executing a manipulation can lead to os command injection. The attack may be launched remotely. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

The Anton Extensions WordPress plugin through 1.2.2 does not perform any capability check, nonce verification, or file-type validation before writing attacker-supplied content to an attacker-chosen path, allowing unauthenticated attackers to upload arbitrary PHP files and achieve remote code execution.

Wukong_HRM through commit 186115e contains an authentication bypass vulnerability in ParamAspect that allows unauthenticated attackers to call every HRM API endpoint by omitting the AUTH-TOKEN header. Attackers gain HR administrator access to read payslips, salary history and employee personal data, download attachments, and modify or delete company-wide HR records.

Unauthenticated PHP Object Injection in Buzz Stone | Magazine & Viral Blog WordPress Theme <= 1.0.2 versions.

Unauthenticated PHP Object Injection in Photolia <= 1.0.3 versions.

Unauthenticated PHP Object Injection in Qwery <= 3.6.1 versions.

Unauthenticated PHP Object Injection in Jacqueline <= 2.22 versions.

Unauthenticated PHP Object Injection in Alliance <= 3.11 versions.

Unauthenticated PHP Object Injection in Kicker <= 2.2.1 versions.

Unauthenticated PHP Object Injection in Original <= 1.9.0 versions.

Unauthenticated PHP Object Injection in Anesta <= 1.5.3 versions.

Unauthenticated PHP Object Injection in FC United <= 1.1.1 versions.

Unauthenticated PHP Object Injection in ShiftCV <= 3.0.14 versions.

Unauthenticated PHP Object Injection in Windsor <= 2.10 versions.

Unauthenticated PHP Object Injection in Education Center <= 3.6.12 versions.

Unauthenticated PHP Object Injection in Drone Media <= 2.2.0 versions.

Contributor Arbitrary File Upload in Creator LMS <= 1.2.21 versions.

Unauthenticated PHP Object Injection in Asia Garden <= 1.3.1 versions.

Unauthenticated PHP Object Injection in N7 | Golf Club Sports & Events <= 2.21 versions.

Unauthenticated PHP Object Injection in Invetex <= 2.18 versions.

Unauthenticated PHP Object Injection in Law Office <= 3.20 versions.

Unauthenticated PHP Object Injection in WineShop <= 3.20 versions.