• 设为首页
  • 点击收藏
  • 手机版
    手机扫一扫访问
    迪恩网络手机版
  • 关注官方公众号
    微信扫一扫关注
    迪恩网络公众号
登陆 注册
描述文字
OGeek|极客世界-中国程序员成长平台 › 门户 › 漏洞›CVE漏洞

CVE漏洞

RSS
  • CVE-2021-24594
    CVE-2021-24594
    The Translate WordPress – Google Language Translator WordPress plugin before 6.0.12 does not sanitise and escape some of its settings before outputting it in various pages, allowing high privileg ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：8 | 回复：0
  • CVE-2021-24607
    CVE-2021-24607
    The Storefront Footer Text WordPress plugin through 1.0.1 does not sanitize and escape the Footer Credit Text added to pages, allowing high privilege users to perform Cross-Site Scripting attacks even ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：11 | 回复：0
  • CVE-2021-24616
    CVE-2021-24616
    The AddToAny Share Buttons WordPress plugin before 1.7.48 does not escape its Image URL button setting, which could lead allow high privilege users to perform Cross-Site Scripting attacks even when th ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：15 | 回复：0
  • CVE-2021-24625
    CVE-2021-24625
    The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leadi ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：18 | 回复：0
  • CVE-2021-24626
    CVE-2021-24626
    The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthor ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：8 | 回复：0
  • CVE-2021-24627
    CVE-2021-24627
    The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：11 | 回复：0
  • CVE-2021-24628
    CVE-2021-24628
    The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an au ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：12 | 回复：0
  • CVE-2021-24629
    CVE-2021-24629
    The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQ ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：18 | 回复：0
  • CVE-2021-24630
    CVE-2021-24630
    The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenti ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：10 | 回复：0
  • CVE-2021-24631
    CVE-2021-24631
    The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as low as editor, leading to an authenticat ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：9 | 回复：0
  • CVE-2021-24645
    CVE-2021-24645
    The Booking.com Product Helper WordPress plugin before 1.0.2 does not sanitize and escape Product Code when creating Product Shortcode, which could allow high privilege users to perform Cross-Site Scr ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：10 | 回复：0
  • CVE-2021-24646
    CVE-2021-24646
    The Booking.com Banner Creator WordPress plugin before 1.4.3 does not properly sanitize inputs when creating banners, which could allow high privilege users to perform Cross-Site Scripting attacks eve ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：6 | 回复：0
  • CVE-2021-24647
    CVE-2021-24647
    The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.1.7.6 has a flaw in the social login implementation, allo ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：9 | 回复：0
  • CVE-2021-24664
    CVE-2021-24664
    The School Management System – WPSchoolPress WordPress plugin before 2.1.17 sanitise some fields using sanitize_text_field() but does not escape them before outputting in attributes, resulting in Sto ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：4 | 回复：0
  • CVE-2021-24669
    CVE-2021-24669
    The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortcode, which allows users with a role as low as Contribut ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：6 | 回复：0
  • CVE-2021-24674
    CVE-2021-24674
    The Genie WP Favicon WordPress plugin through 0.5.2 does not have CSRF in place when updating the favicon, which could allow attackers to make a logged in admin change it via a CSRF attack……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：20 | 回复：0
  • CVE-2021-24693
    CVE-2021-24693
    The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the File Thumbnail post meta before outputting it in some pages, which could allow users with a role as low as Contributor to ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：6 | 回复：0
  • CVE-2021-24695
    CVE-2021-24695
    The Simple Download Monitor WordPress plugin before 3.9.6 saves logs in a predictable location, and does not have any authentication or authorisation in place to prevent unauthenticated users to downl ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：16 | 回复：0
  • CVE-2021-24697
    CVE-2021-24697
    The Simple Download Monitor WordPress plugin before 3.9.5 does not escape the 1) sdm_active_tab GET parameter and 2) sdm_stats_start_date/sdm_stats_end_date POST parameters before outputting them back ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：16 | 回复：0
  • CVE-2021-24698
    CVE-2021-24698
    The Simple Download Monitor WordPress plugin before 3.9.6 allows users with a role as low as Contributor to remove thumbnails from downloads they do not own, even if they cannot normally edit the down ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：12 | 回复：0
  • CVE-2021-24701
    CVE-2021-24701
    The Quiz Tool Lite WordPress plugin through 2.3.15 does not sanitize multiple input fields used when creating or managing quizzes and in other setting options, allowing high privilege users to perform ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：12 | 回复：0
  • CVE-2021-24706
    CVE-2021-24706
    The Qwizcards – online quizzes and flashcards WordPress plugin before 3.62 does not properly sanitize and escape some of its settings, allowing high privilege users to perform Cross-Site Scriptin ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：11 | 回复：0
  • CVE-2021-24708
    CVE-2021-24708
    The Export any WordPress data to XML/CSV WordPress plugin before 1.3.1 does not escape its Export's Name before outputting it in Manage Exports settings, which could allow high privilege users to ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：45 | 回复：0
  • CVE-2021-24710
    CVE-2021-24710
    The Print-O-Matic WordPress plugin before 2.0.3 does not escape some of its settings before outputting them in attribute, which could allow high privilege users to perform Cross-Site Scripting attacks ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：20 | 回复：0
  • CVE-2021-24721
    CVE-2021-24721
    The Loco Translate WordPress plugin before 2.5.4 mishandles data inputs which get saved to a file, which can be renamed to an extension ending in .php, resulting in authenticated translator users bein ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：35 | 回复：0
  • CVE-2021-24731
    CVE-2021-24731
    The Registration Forms – User profile, Content Restriction, Spam Protection, Payment Gateways, Invitation Codes WordPress plugin before 3.7.1.6 does not properly escape user data before using it ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：32 | 回复：0
  • CVE-2021-24766
    CVE-2021-24766
    The 404 to 301 – Redirect, Log and Notify 404 Errors WordPress plugin before 3.0.9 does not have CSRF check in place when cleaning the logs, which could allow attacker to make a logged in admin d ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：34 | 回复：0
  • CVE-2021-24767
    CVE-2021-24767
    The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete t ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：29 | 回复：0
  • CVE-2021-24783
    CVE-2021-24783
    The Post Expirator WordPress plugin before 2.6.0 does not have proper capability checks in place, which could allow users with a role as low as Contributor to schedule deletion of arbitrary posts.……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：19 | 回复：0
  • CVE-2021-24788
    CVE-2021-24788
    The Batch Cat WordPress plugin through 0.3 defines 3 custom AJAX actions, which both require authentication but are available for all roles. As a result, any authenticated user (including simple subsc ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：30 | 回复：0
  • CVE-2021-24791
    CVE-2021-24791
    The Header Footer Code Manager WordPress plugin before 1.1.14 does not validate and escape the orderby and order request parameters before using them in a SQL statement when viewing the Snippets admin ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：21 | 回复：0
  • CVE-2021-24798
    CVE-2021-24798
    The WP Header Images WordPress plugin before 2.0.1 does not sanitise and escape the t parameter before outputting it back in the plugin's settings page, leading to a Reflected Cross-Site Scripting ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：28 | 回复：0
  • CVE-2021-24801
    CVE-2021-24801
    The WP Survey Plus WordPress plugin through 1.0 does not have any authorisation and CSRF checks in place in its AJAX actions, allowing any user to call them and add/edit/delete Surveys. Furthermore, d ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：21 | 回复：0
  • CVE-2021-24806
    CVE-2021-24806
    The wpDiscuz WordPress plugin before 7.3.4 does check for CSRF when adding, editing and deleting comments, which could allow attacker to make logged in users such as admin edit and delete arbitrary co ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：22 | 回复：0
  • CVE-2021-24807
    CVE-2021-24807
    The Support Board WordPress plugin before 3.3.5 allows Authenticated (Agent+) users to perform Cross-Site Scripting attacks by placing a payload in the notes field, when an administrator or any authen ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：21 | 回复：0
  • CVE-2021-24816
    CVE-2021-24816
    The Phoenix Media Rename WordPress plugin before 3.4.4 does not have capability checks in its phoenix_media_rename AJAX action, which could allow users with Author roles to rename any uploaded media f ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：8 | 回复：0
  • CVE-2021-24827
    CVE-2021-24827
    The Asgaros Forum WordPress plugin before 1.15.13 does not validate and escape user input when subscribing to a topic before using it in a SQL statement, leading to an unauthenticated SQL injection is ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：10 | 回复：0
  • CVE-2021-24829
    CVE-2021-24829
    The Visitor Traffic Real Time Statistics WordPress plugin before 3.9 does not validate and escape user input passed to the today_traffic_index AJAX action (available to any authenticated users) before ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：42 | 回复：0
  • CVE-2021-24832
    CVE-2021-24832
    The WP SEO Redirect 301 WordPress plugin before 2.3.2 does not have CSRF in place when deleting redirects, which could allow attackers to make a logged in admin delete them via a CSRF attack……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：22 | 回复：0
  • CVE-2021-24835
    CVE-2021-24835
    The WCFM – Frontend Manager for WooCommerce along with Bookings Subscription Listings Compatible WordPress plugin before 6.5.12, when used in combination with another WCFM - WooCommerce Multivend ...……
    作者：菜鸟教程小白 | 时间：2022-2-5 12:31 | 阅读：10 | 回复：0

关注我们

极客给你想要的成长

关注极客中国获取最新资讯

加入Q群 官方微博
热门推荐
More+
专题导读
More+
热门话题
More+
阅读排行榜

扫描微信二维码

查看手机版网站

随时了解更新最新资讯

139-2527-9053

在线客服（服务时间 9:00～18:00）

在线QQ客服
地址：深圳市南山区西丽大学城创智工业园
电邮：jeky_zhao#qq.com
移动电话：139-2527-9053

Powered by 互联科技 X3.4© 2001-2213 极客世界.|Sitemap