CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-32447 – WordPress AWP Classifieds plugin <= 4.3.1 - Cross Site Request Forgery (CSRF) vulnerability
https://notcve.org/view.php?id=CVE-2024-32447
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team AWP Classifieds.This issue affects AWP Classifieds: from n/a through 4.3.1. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en AWP Classifieds Team AWP Classifieds. Este problema afecta a AWP Classifieds: desde n/a hasta 4.3.1. The AWP Classifieds plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3.1. This is due to missing or incorrect nonce validation on the ajax() function. • https://patchstack.com/database/vulnerability/another-wordpress-classifieds-plugin/wordpress-awp-classifieds-plugin-4-3-1-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 4.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-31350 – WordPress AWP Classifieds plugin <= 4.3.1 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2024-31350
Missing Authorization vulnerability in AWP Classifieds Team AWP Classifieds.This issue affects AWP Classifieds: from n/a through 4.3.1. Vulnerabilidad de autorización faltante en AWP Classifieds Team AWP Classifieds. Este problema afecta a AWP Classifieds: desde n/a hasta 4.3.1. The AWP Classifieds plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in versions up to, and including, 4.3.1. This makes it possible for authenticated attackers, with subscriber-level access and above, to perform an unauthorized action. • https://patchstack.com/database/vulnerability/another-wordpress-classifieds-plugin/wordpress-awp-classifieds-plugin-4-3-1-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41801 – WordPress AWP Classifieds Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-41801
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento AWP Classifieds Team Ad Directory & Listings by AWP Classifieds en versiones <= 4.3. The AWP Classifieds plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3. This is due to missing nonce validation on several functions such as dispatch(), try_to_delete_categories(), try_to_update_category(), try_to_move_categories(), and more. This makes it possible for unauthenticated attackers to manage categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/another-wordpress-classifieds-plugin/wordpress-classifieds-plugin-ad-directory-listings-plugin-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3254 – AWP Classifieds Plugin < 4.3 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2022-3254
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection El complemento de anuncios clasificados de WordPress El complemento de WordPress anterior a 4.3 no sanitiza y escapa adecuadamente algunos parámetros antes de usarlos en una declaración SQL a través de una acción AJAX disponible para usuarios no autenticados y cuando un módulo premium específico está activo, lo que lleva a una inyección de SQL. The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://wpscan.com/vulnerability/546c47c2-5b4b-46db-b754-c6b43aef2660 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2014-10013 – WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds < 3.0 - SQL Injection
https://notcve.org/view.php?id=CVE-2014-10013
SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the keywordphrase parameter in a dosearch action. Vulnerabilidad de inyección SQL en el plugin Another WordPress Classifieds Plugin para WordPress permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro keywordphrase en una acción dosearch. • https://www.exploit-db.com/exploits/35204 http://packetstormsecurity.com/files/129035/Another-WordPress-Classifieds-Cross-Site-Scripting-SQL-Injection.html http://www.exploit-db.com/exploits/35204 https://exchange.xforce.ibmcloud.com/vulnerabilities/98589 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •