Export limit exceeded: 45364 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (45364 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-24356 | 1 Wpdeveloper | 1 Simple 301 Redirects | 2024-11-21 | 8.8 High |
| In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, a lack of capability checks and insufficient nonce check on the AJAX action, simple301redirects/admin/activate_plugin, made it possible for authenticated users to activate arbitrary plugins installed on vulnerable sites. | ||||
| CVE-2021-24355 | 1 Wpdeveloper | 1 Simple 301 Redirects | 2024-11-21 | 4.3 Medium |
| In the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, the lack of capability checks and insufficient nonce check on the AJAX actions, simple301redirects/admin/get_wildcard and simple301redirects/admin/wildcard, made it possible for authenticated users to retrieve and update the wildcard value for redirects. | ||||
| CVE-2021-24354 | 1 Wpdeveloper | 1 Simple 301 Redirects | 2024-11-21 | 8.8 High |
| A lack of capability checks and insufficient nonce check on the AJAX action in the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4, made it possible for authenticated users to install arbitrary plugins on vulnerable sites. | ||||
| CVE-2021-24353 | 1 Wpdeveloper | 1 Simple 301 Redirects | 2024-11-21 | 8.8 High |
| The import_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to import a set of site redirects. | ||||
| CVE-2021-24352 | 1 Wpdeveloper | 1 Simple 301 Redirects | 2024-11-21 | 8.8 High |
| The export_data function of the Simple 301 Redirects by BetterLinks WordPress plugin before 2.0.4 had no capability or nonce checks making it possible for unauthenticated users to export a site's redirects. | ||||
| CVE-2021-24348 | 1 Wow-estore | 1 Side Menu | 2024-11-21 | 7.2 High |
| The menu delete functionality of the Side Menu – add fixed side buttons WordPress plugin before 3.1.5, available to Administrator users takes the did GET parameter and uses it into an SQL statement without proper sanitisation, validation or escaping, therefore leading to a SQL Injection issue | ||||
| CVE-2021-24345 | 1 Sendit Project | 1 Sendit | 2024-11-21 | 6.6 Medium |
| The page lists-management feature of the Sendit WP Newsletter WordPress plugin through 2.5.1, available to Administrator users does not sanitise, validate or escape the id_lista POST parameter before using it in SQL statement, therefore leading to Blind SQL Injection. | ||||
| CVE-2021-24341 | 1 Xllentech | 1 English Islamic Calendar | 2024-11-21 | 8.8 High |
| When deleting a date in the Xllentech English Islamic Calendar WordPress plugin before 2.6.8, the year_number and month_number POST parameters are not sanitised, escaped or validated before being used in a SQL statement, leading to SQL injection. | ||||
| CVE-2021-24340 | 1 Veronalabs | 1 Wp Statistics | 2024-11-21 | 7.5 High |
| The WP Statistics WordPress plugin before 13.0.8 relied on using the WordPress esc_sql() function on a field not delimited by quotes and did not first prepare the query. Additionally, the page, which should have been accessible to administrator only, was also available to any visitor, including unauthenticated ones. | ||||
| CVE-2021-24337 | 1 Video-embed-box Project | 1 Video-embed-box | 2024-11-21 | 8.8 High |
| The id GET parameter of one of the Video Embed WordPress plugin through 1.0's page (available via forced browsing) is not sanitised, validated or escaped before being used in a SQL statement, allowing low privilege users, such as subscribers, to perform SQL injection. | ||||
| CVE-2021-24336 | 1 Zavedil | 1 Flightlog | 2024-11-21 | 7.2 High |
| The FlightLog WordPress plugin through 3.0.2 does not sanitise, validate or escape various POST parameters before using them a SQL statement, leading to SQL injections exploitable by editor and administrator users | ||||
| CVE-2021-24321 | 1 Bold-themes | 1 Bello | 2024-11-21 | 9.8 Critical |
| The Bello - Directory & Listing WordPress theme before 1.6.0 did not sanitise the bt_bb_listing_field_price_range_to, bt_bb_listing_field_now_open, bt_bb_listing_field_my_lng, listing_list_view and bt_bb_listing_field_my_lat parameters before using them in a SQL statement, leading to SQL Injection issues | ||||
| CVE-2021-24314 | 1 Boostifythemes | 1 Goto | 2024-11-21 | 9.8 Critical |
| The Goto WordPress theme before 2.1 did not sanitise, validate of escape the keywords GET parameter from its listing page before using it in a SQL statement, leading to an Unauthenticated SQL injection issue | ||||
| CVE-2021-24303 | 1 Jiangqie | 1 Official Website Mini Program | 2024-11-21 | 8.8 High |
| The JiangQie Official Website Mini Program WordPress plugin before 1.1.1 does not escape or validate the id GET parameter before using it in SQL statements, leading to SQL injection issues | ||||
| CVE-2021-24295 | 1 Cleantalk | 1 Spam Protection\, Antispam\, Firewall | 2024-11-21 | 7.5 High |
| It was possible to exploit an Unauthenticated Time-Based Blind SQL Injection vulnerability in the Spam protection, AntiSpam, FireWall by CleanTalk WordPress Plugin before 5.153.4. The update_log function in lib/Cleantalk/ApbctWP/Firewall/SFW.php included a vulnerable query that could be injected via the User-Agent Header by manipulating the cookies set by the Spam protection, AntiSpam, FireWall by CleanTalk WordPress plugin before 5.153.4, sending an initial request to obtain a ct_sfw_pass_key cookie and then manually setting a separate ct_sfw_passed cookie and disallowing it from being reset. | ||||
| CVE-2021-24285 | 1 Cars-seller-auto-classifieds-script Project | 1 Cars-seller-auto-classifieds-script | 2024-11-21 | 9.8 Critical |
| The request_list_request AJAX call of the Car Seller - Auto Classifieds Script WordPress plugin through 2.1.0, available to both authenticated and unauthenticated users, does not sanitise, validate or escape the order_id POST parameter before using it in a SQL statement, leading to a SQL Injection issue. | ||||
| CVE-2021-24282 | 1 Querysol | 1 Redirection For Contact Form 7 | 2024-11-21 | 6.3 Medium |
| In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the various AJAX actions in the plugin to do a variety of things. For example, an attacker could use wpcf7r_reset_settings to reset the plugin’s settings, wpcf7r_add_action to add actions to a form, and more. | ||||
| CVE-2021-24281 | 1 Querysol | 1 Redirection For Contact Form 7 | 2024-11-21 | 4.3 Medium |
| In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, any authenticated user, such as a subscriber, could use the delete_action_post AJAX action to delete any post on a target site. | ||||
| CVE-2021-24279 | 1 Querysol | 1 Redirection For Contact Form 7 | 2024-11-21 | 6.5 Medium |
| In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, low level users, such as subscribers, could use the import_from_debug AJAX action to install any plugin from the WordPress repository. | ||||
| CVE-2021-24278 | 1 Querysol | 1 Redirection For Contact Form 7 | 2024-11-21 | 7.5 High |
| In the Redirection for Contact Form 7 WordPress plugin before 2.3.4, unauthenticated users can use the wpcf7r_get_nonce AJAX action to retrieve a valid nonce for any WordPress action/function. | ||||