Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 16

Export CSV
CVE-2024-47636

WordPress WP JobSearch plugin <= 2.5.9 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in eyecix JobSearch wp-jobsearch allows Object Injection.This issue affects JobSearch: from n/a through <= 2.5.9.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2024-11925

WP JobSearch <= 2.6.7 - Authentication Bypass to Account Takeover and Privilege Escalation

The JobSearch WP Job Board plugin for WordPress is vulnerable to privilege escalation in all versions up to, and including, 2.6.7. This is due to the plugin not properly verifying a users identity when verifying an email address through the user_account_activation function. This makes it possible for unauthenticated attackers to log in as any user, including site administrators if the users email is known.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2024-43245

WordPress JobSearch plugin <= 2.3.4 - Unauthenticated Account Takeover vulnerability

Improper Privilege Management vulnerability in eyecix JobSearch allows Privilege Escalation.This issue affects JobSearch: from n/a through 2.3.4.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2024-11917

JobSearch WP Job Board <= 2.9.2 - Authentication Bypass via Social Logins

The JobSearch WP Job Board plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 2.9.2. This is due to improper configurations in the 'jobsearch_xing_response_data_callback', 'set_access_tokes', and 'google_callback' functions. This makes it possible for unauthenticated attackers to log in as the first connected Xing user, or any connected Xing user if the Xing id is known. It is also possible for unauthenticated attackers to log in as the first connected Google user if the user has logged in, without subsequently logging out, in thirty days. The vulnerability was partially patched in version 2.8.4.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2021-4364

JobSearch WP Job Board < = 1.8.1 - Missing Authorization on jobsearch_update_job_import_schedule_call() function

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_add_job_import_schedule_call() function in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to add and/or modify schedule calls.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2021-4361

JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Arbitrary Options Update

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the jobsearch_job_integrations_settin_save AJAX action in versions up to, and including, 1.8.1. This makes it possible for authenticated attackers to update arbitrary options on the site.

CVSS 3.1 · 8.8 High EPSS 1.2% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2021-4352

JobSearch WP Job Board <= 1.8.1 - Missing Authorization to Settings Change

The JobSearch WP Job Board plugin for WordPress is vulnerable to authorization bypass due to a missing capability check on the save_locsettings function in versions up to, and including, 1.8.1. This makes it possible for unauthenticated attackers to change the settings of the plugin.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2024-8615

WP JobSearch <= 2.6.7 - Unauthenticated Arbitrary File Upload

The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_location_load_excel_file_callback() function in all versions up to, and including, 2.6.7. This makes it possible for unauthenticated attackers to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2024-8614

WP JobSearch <= 2.6.7 - Authenticated (Subscriber+) Arbitrary File Upload

The JobSearch WP Job Board plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the jobsearch_wp_handle_upload() function in all versions up to, and including, 2.6.7. This makes it possible for authenticated attackers, with subscriber-level access and above, to upload arbitrary files on the affected site's server which may make remote code execution possible.

CVSS 3.1 · 9.9 Critical EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2023-6585

JobSearch WP Job Board < 2.3.4 - Arbitrary File Upload to RCE

The WP JobSearch WordPress plugin before 2.3.4 does not validate files to be uploaded, which could allow unauthenticated attackers to upload arbitrary files such as PHP on the server

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2022-1168

JobSearch < 1.5.1 - Unauthenticated Reflected Cross-Site Scripting (XSS)

There is a Cross-Site Scripting vulnerability in the JobSearch WP JobSearch WordPress plugin before 1.5.1.

CVSS 3.1 · 6.1 Medium EPSS 1.6% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2021-24421

WP JobSearch < 1.7.4 - Authenticated Stored XSS

The WP JobSearch WordPress plugin before 1.7.4 did not sanitise or escape multiple of its parameters from the my-resume page before outputting them in the page, allowing low privilege users to use JavaScript payloads in them and leading to a Stored Cross-Site Scripting issue

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2024-43929

WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in eyecix JobSearch allows Accessing Functionality Not Properly Constrained by ACLs.This issue affects JobSearch: from n/a through 2.5.4.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2024-43928

WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.4 - Broken Access Control vulnerability

Missing Authorization vulnerability in eyecix JobSearch allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects JobSearch: from n/a through 2.5.4.

CVSS 3.1 · 5.4 Medium EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board
CVE-2024-43931

WordPress JobSearch WP Job Board WordPress Plugin plugin <= 2.5.3 - PHP Object Injection vulnerability

Deserialization of Untrusted Data vulnerability in eyecix JobSearch allows Object Injection.This issue affects JobSearch: from n/a through 2.5.3.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Eyecix
Products
Jobsearch Wp Job Board