CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32447 – WordPress AWP Classifieds plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2024-32447
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team AWP Classifieds.This issue affects AWP Classifieds: from n/a through 4.3.1. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en AWP Classifieds Team AWP Classifieds. Este problema afecta a AWP Classifieds: desde n/a hasta 4.3.1. The AWP Classifieds plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on the ajax() function. • https://patchstack.com/database/vulnerability/another-wordpress-classifieds-plugin/wordpress-awp-classifieds-plugin-4-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31350 – WordPress AWP Classifieds plugin <= 4.3.1 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-31350
Missing Authorization vulnerability in AWP Classifieds Team AWP Classifieds.This issue affects AWP Classifieds: from n/a through 4.3.1. Vulnerabilidad de autorización faltante en AWP Classifieds Team AWP Classifieds. Este problema afecta a AWP Classifieds: desde n/a hasta 4.3.1. The AWP Classifieds plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action. • https://patchstack.com/database/vulnerability/another-wordpress-classifieds-plugin/wordpress-awp-classifieds-plugin-4-3-1-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41801 – WordPress AWP Classifieds Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-41801
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento AWP Classifieds Team Ad Directory & Listings by AWP Classifieds en versiones <= 4.3. The AWP Classifieds plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3. This is due to missing nonce validation on several functions such as dispatch(), try_to_delete_categories(), try_to_update_category(), try_to_move_categories(), and more. This makes it possible for unauthenticated attackers to manage categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/another-wordpress-classifieds-plugin/wordpress-classifieds-plugin-ad-directory-listings-plugin-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3254 – AWP Classifieds Plugin < 4.3 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2022-3254
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection El complemento de anuncios clasificados de WordPress El complemento de WordPress anterior a 4.3 no sanitiza y escapa adecuadamente algunos parámetros antes de usarlos en una declaración SQL a través de una acción AJAX disponible para usuarios no autenticados y cuando un módulo premium específico está activo, lo que lleva a una inyección de SQL. The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://wpscan.com/vulnerability/546c47c2-5b4b-46db-b754-c6b43aef2660 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2012-4874 – WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds < 2.0 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2012-4874
Unspecified vulnerability in the Another WordPress Classifieds Plugin before 2.0 for WordPress has unknown impact and attack vectors related to "image uploads." Vulnerabilidad no especificada en el plugin Another WordPress Classifieds anterior a v2.0 tiene un impacto desconocido y vectores de ataque similares a "archivos de imagen." The WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the admin_handleimagesupload function in versions up to, and including, 1.8.9.4. This makes it possible for authenticated attackers, with administrator-level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible. • http://osvdb.org/80881 http://secunia.com/advisories/47335 http://wordpress.org/extend/plugins/another-wordpress-classifieds-plugin/changelog http://www.securityfocus.com/bid/52861 • CWE-434: Unrestricted Upload of File with Dangerous Type •