Vulnerabilidades de Rnags
CVEs publicadas que afetam produtos de Rnags: 2 registro(s), com severidade, exploração e correções.
CVE-2025-12579
Média · 5.3
CWE-862 27/11/2025
Reuters Direct <= 3.0.0 - Missing Authorization to Unauthenticated Settings Reset
The Reuters Direct plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'logoff' action in all versions up to, and including, 3.0.0. This makes it possible for unauthenticated attackers to reset the plugin's settings.
CVE-2025-12578
Média · 4.3
CWE-352 27/11/2025
Reuters Direct <= 3.0.0 - Cross-Site Request Forgery to Settings Reset
The Reuters Direct plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.0.0. This is due to missing or incorrect nonce validation on the the 'class-reuters-direct-settings.php' page. This makes it possible for unauthenticated attackers to reset the plugin's settings via a forged request granted they can trick a site administrator into performing an action such as clicking on a link.