CVE-2021-24883
The Popup Anything WordPress plugin before 2.0.4 does not escape the Link Text and Button Text fields of Popup, which could allow […]
İçeriği inceleyinALLSAFE / Güncel Güvenlik Açıkları
Güvenlik Açıkları
NIST NVD, USOM / Siber Güvenlik Başkanlığı ve Exploit-DB kaynaklarından güvenlik bildirimleri. Etkilenen ürün ve sürümleri özgün kaynakta doğrulayın.
Kayıtlar kaynakların yayın tarihleri ve özgün içerikleriyle sunulur. Bir kaydın bulunması, kurumunuzun etkilendiğini tek başına göstermez. Sürüm ve yapılandırmayı kontrol ederek üreticinin güncel önerilerini değerlendirin.
CVE-2021-24889
The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high […]
İçeriği inceleyinCVE-2021-24899
The Media-Tags WordPress plugin through 3.2.0.2 does not sanitise and escape any of its Labels settings, which could allow high privilege users […]
İçeriği inceleyinCVE-2021-24908
The Check & Log Email WordPress plugin before 1.0.4 does not escape the d parameter before outputting it back in an attribute, […]
İçeriği inceleyinCVE-2021-24915
The Contest Gallery WordPress plugin before 13.1.0.6 does not have capability checks and does not sanitise or escape the cg-search-user-name-original parameter before […]
İçeriği inceleyinCVE-2017-20008 (mycred)
The myCred WordPress plugin before 1.7.8 does not sanitise and escape the user parameter before outputting it back in the Points Log […]
İçeriği inceleyinCVE-2021-24745 (about_author_box)
The About Author Box WordPress plugin before 1.0.2 does not sanitise and escape the Social Profiles field values before outputting them in […]
İçeriği inceleyinCVE-2021-24748 (email_before_download)
The Email Before Download WordPress plugin before 6.8 does not properly validate and escape the order and orderby GET parameters before using […]
İçeriği inceleyinCVE-2021-24749 (url_shortify)
The URL Shortify WordPress plugin before 1.5.1 does not have CSRF check in place when bulk-deleting links or groups, which could allow […]
İçeriği inceleyinCVE-2021-24751 (generateblocks)
The GenerateBlocks WordPress plugin before 1.4.0 does not validate the generateblocks/container block's tagName attribute, which could allow users with a role as […]
İçeriği inceleyinCVE-2021-24755 (mycred)
The myCred WordPress plugin before 2.3 does not validate or escape the fields parameter before using it in a SQL statement, leading […]
İçeriği inceleyinCVE-2021-24768 (wp_rss_aggregator)
The WP RSS Aggregator WordPress plugin before 4.19.2 does not properly sanitise and escape the URL to Blacklist field, allowing malicious HTML […]
İçeriği inceleyin