Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 88

Export CSV
CVE-2021-24761

Error Log Viewer < 1.1.2 - Arbitrary Text File Deletion via CSRF

The Error Log Viewer WordPress plugin before 1.1.2 does not perform nonce check when deleting a log file and does not have path traversal prevention, which could allow attackers to make a logged in admin delete arbitrary text files on the web server.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Bestwebsoft
Products
Error Log Viewer
CVE-2021-24350

Visitors <= 0.3 - Unauthenticated Stored Cross-Site Scripting (XSS)

The Visitors WordPress plugin through 0.3 is affected by an Unauthenticated Stored Cross-Site Scripting (XSS) vulnerability. The plugin would display the user's user agent string without validation or encoding within the WordPress admin panel.

CVSS 3.1 · 6.1 Medium EPSS 1.3% KEV · Not listed
Vendors
Bestwebsoft
Products
Visitors Online
CVE-2020-8658

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccess_editor CSRF. The flag htccss_nonce_name passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In this way, an attacker is able to direct the victim to a malicious web page that modifies the .htaccess file, and takes control of the website.

CVSS 3.1 · 8.8 High EPSS 9.9% KEV · Not listed
Vendors
Bestwebsoft
Products
Htaccess
CVE-2017-18530

The rating-bws plugin before 0.2 for WordPress has multiple XSS issues.

CVSS 3.0 · 6.1 Medium EPSS 1.4% KEV · Not listed
Vendors
Bestwebsoft
Products
Rating
CVE-2017-18518

The bws-smtp plugin before 1.1.0 for WordPress has multiple XSS issues.

CVSS 3.0 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Bestwebsoft
Products
Smtp