Archives: Reports

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check in the gf_billingo_pro_deactivate AJAX action, which makes it possible for attackers to deactivate the plugin’s license via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check in the gf_szamlazz_pro_deactivate AJAX action, which makes it possible for attackers to deactivate the plugin’s license via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check, and it’s also contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for attackers to inject arbitrary web scripts into pages via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Missing Authorization vulnerability due to a missing capability check, which makes it possible for authenticated attackers with a role as low as subscriber to reset plugin settings.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the SBF_DB_code_manage_action AJAX action, which makes it possible for authenticated attackers with a role as low as subscribers to add, edit or delete bonds. The plugin also contains a Cross-Site Scripting (XSS) vulnerability, due to the plugin does not sanitize and escape some parameters, which makes it possible to inject arbitrary web scripts.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check when saving the plugin settings, and it’s also contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for attackers to inject arbitrary web scripts into pages via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the mo_discord_disable_app AJAX action, which makes it possible for authenticated attackers with a role as low as subscriber to disable an app.

The plugin contains a Cross-Site Scripting (XSS) vulnerability due to the plugin does not sanitize and escape some parameters, which makes it possible for authenticated attackers with a role as low as administrator to inject arbitrary web scripts.

The plugin contains a Cross-Site Request Forgery (CSRF) vulnerability due to a missing nonce check, which makes it possible for attackers to perform actions via a forged request if they can trick an administrator into performing an action such as clicking on a link.

The plugin contains an Auth Bypass vulnerability due to a missing capability check in the ldapConfig action, which makes it possible for unauthenticated attackers to update the LDAP server config, witch can be used to bypass authentication in the website.

The plugin contains an Auth Bypass vulnerability due to a missing capability check in the oauthconfig action, which makes it possible for unauthenticated attackers to update the OAuth endpoints, which leads to authentication bypass. To bypass authentication, the attacker only needs to know the user’s email address. Depending on the obtained email address, the attacker may even get an administrator role on the client’s website.

The plugin contains a Missing Authorization vulnerability due to a missing capability check in the pm_messenger_show_messages and pm_messenger_send_new_message AJAX actions, which makes it possible for authenticated attackers with a role as low as subscriber to read and edit other user’s messages.

The plugin contains an Auth Bypass vulnerability. To bypass authentication, the attacker only needs to know the user’s email address. Depending on the obtained email address, the attacker may even get an administrator role on the client’s website.

The plugin contains an Auth Bypass vulnerability. To bypass authentication, the attacker only needs to know the user’s email address. Depending on the obtained email address, the attacker may even get an administrator role on the client’s website.

The plugin contains an Auth Bypass vulnerability. To bypass authentication, the attacker only needs to know user’s username. Depending on the username, which can be easily queried because it is usually public data, the attacker may even get an administrator role on the client’s website.

The plugin contains an Auth Bypass vulnerability due to the plugin leaks its OAuth client_secret, that can be used to authenticate to the client’s website. Depending on the OAuth server settings, the attacker may even get an administrator role on the client’s website.