Export limit exceeded: 46946 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (46946 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2021-24677 | 1 Find My Blocks Project | 1 Find My Blocks | 2024-11-21 | 5.3 Medium |
| The Find My Blocks WordPress plugin before 3.4.0 does not have authorisation checks in its REST API, which could allow unauthenticated users to enumerate private posts' titles. | ||||
| CVE-2021-24669 | 1 Feataholic | 1 Maz Loader | 2024-11-21 | 8.8 High |
| The MAZ Loader – Preloader Builder for WordPress plugin before 1.3.3 does not validate or escape the loader_id parameter of the mzldr shortcode, which allows users with a role as low as Contributor to perform SQL injection. | ||||
| CVE-2021-24666 | 1 Podlove | 1 Podlove Podcast Publisher | 2024-11-21 | 9.8 Critical |
| The Podlove Podcast Publisher WordPress plugin before 3.5.6 contains a 'Social & Donations' module (not activated by default), which adds the rest route '/services/contributor/(?P<id>[\d]+), takes an 'id' and 'category' parameters as arguments. Both parameters can be used for the SQLi. | ||||
| CVE-2021-24662 | 1 Game-server-status Project | 1 Game-server-status | 2024-11-21 | 7.2 High |
| The Game Server Status WordPress plugin through 1.0 does not validate or escape the server_id parameter before using it in SQL statement, leading to an Authenticated SQL Injection in an admin page | ||||
| CVE-2021-24652 | 1 Wpxpo | 1 Postx - Gutenberg Blocks For Post Grid | 2024-11-21 | 6.5 Medium |
| The PostX – Gutenberg Blocks for Post Grid WordPress plugin before 2.4.10 performs incorrect checks before allowing any logged in user to perform some ajax based requests, allowing any user to modify, delete or add ultp_options values. | ||||
| CVE-2021-24651 | 1 Ays-pro | 1 Poll Maker | 2024-11-21 | 7.5 High |
| The Poll Maker WordPress plugin before 3.4.2 allows unauthenticated users to perform SQL injection via the ays_finish_poll AJAX action. While the result is not disclosed in the response, it is possible to use a timing attack to exfiltrate data such as password hash. | ||||
| CVE-2021-24639 | 1 Ffw | 1 Omgf | 2024-11-21 | 8.1 High |
| The OMGF WordPress plugin before 4.5.4 does not enforce path validation, authorisation and CSRF checks in the omgf_ajax_empty_dir AJAX action, which allows any authenticated users to delete arbitrary files or folders on the server. | ||||
| CVE-2021-24635 | 1 Bootstrapped | 1 Visual Link Preview | 2024-11-21 | 5.4 Medium |
| The Visual Link Preview WordPress plugin before 2.2.3 does not enforce authorisation on several AJAX actions and has the CSRF nonce displayed for all authenticated users, allowing any authenticated user (such as subscriber) to call them and 1) Get and search through title and content of Draft post, 2) Get title of a password-protected post as well as 3) Upload an image from an URL | ||||
| CVE-2021-24633 | 1 Wpdeveloper | 1 Countdown Block | 2024-11-21 | 4.3 Medium |
| The Countdown Block WordPress plugin before 1.1.2 does not have authorisation in the eb_write_block_css AJAX action, which allows any authenticated user, such as Subscriber, to modify post contents displayed to users. | ||||
| CVE-2021-24631 | 1 Unlimited Popups Project | 1 Unlimited Popups | 2024-11-21 | 8.8 High |
| The Unlimited PopUps WordPress plugin through 4.5.3 does not sanitise or escape the did GET parameter before using it in a SQL statement, available to users as low as editor, leading to an authenticated SQL Injection | ||||
| CVE-2021-24630 | 1 Schreikasten Project | 1 Schreikasten | 2024-11-21 | 8.8 High |
| The Schreikasten WordPress plugin through 0.14.18 does not sanitise or escape the id GET parameter before using it in SQL statements in the comments dashboard from various actions, leading to authenticated SQL Injections which can be exploited by users as low as author | ||||
| CVE-2021-24629 | 1 Post Content Xmlrpc Project | 1 Post Content Xmlrpc | 2024-11-21 | 7.2 High |
| The Post Content XMLRPC WordPress plugin through 1.0 does not sanitise or escape multiple GET/POST parameters before using them in SQL statements in the admin dashboard, leading to an authenticated SQL Injections | ||||
| CVE-2021-24628 | 1 Wow-company | 1 Wow Forms | 2024-11-21 | 7.2 High |
| The Wow Forms WordPress plugin through 3.1.3 does not sanitise or escape a 'did' GET parameter before using it in a SQL statement, when deleting a form in the admin dashboard, leading to an authenticated SQL injection | ||||
| CVE-2021-24627 | 1 G Auto-hyperlink Project | 1 G Auto-hyperlink | 2024-11-21 | 7.2 High |
| The G Auto-Hyperlink WordPress plugin through 1.0.1 does not sanitise or escape an 'id' GET parameter before using it in a SQL statement, to select data to be displayed in the admin dashboard, leading to an authenticated SQL injection | ||||
| CVE-2021-24626 | 1 Chameleon Css Project | 1 Chameleon Css | 2024-11-21 | 8.8 High |
| The Chameleon CSS WordPress plugin through 1.2 does not have any CSRF and capability checks in all its AJAX calls, allowing any authenticated user, such as subscriber to call them and perform unauthorised actions. One of AJAX call, remove_css, also does not sanitise or escape the css_id POST parameter before using it in a SQL statement, leading to a SQL Injection | ||||
| CVE-2021-24625 | 1 Web-dorado | 1 Spidercatalog | 2024-11-21 | 7.2 High |
| The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category | ||||
| CVE-2021-24606 | 1 Offshorewebmaster | 1 Availability Calendar | 2024-11-21 | 8.8 High |
| The Availability Calendar WordPress plugin before 1.2.1 does not escape the category attribute from its shortcode before using it in a SQL statement, leading to a SQL Injection issue, which can be exploited by any user able to add shortcode to posts/pages, such as contributor+ | ||||
| CVE-2021-24580 | 1 Wow-estore | 1 Side Menu | 2024-11-21 | 8.8 High |
| The Side Menu Lite WordPress plugin before 2.2.6 does not sanitise user input from the List page in the admin dashboard before using it in SQL statement, leading to a SQL Injection issue | ||||
| CVE-2021-24575 | 1 Igexsolutions | 1 Wpschoolpress | 2024-11-21 | 8.8 High |
| The School Management System – WPSchoolPress WordPress plugin before 2.1.10 does not properly sanitize or use prepared statements before using POST variable in SQL queries, leading to SQL injection in multiple actions available to various authenticated users, from simple subscribers/students to teachers and above. | ||||
| CVE-2021-24557 | 1 Nimble3 | 1 M-vslider | 2024-11-21 | 7.2 High |
| The update functionality in the rslider_page uses an rs_id POST parameter which is not validated, sanitised or escaped before being inserted in sql query, therefore leading to SQL injection for users having Administrator role. | ||||