2 results (0.018 seconds)

CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-46821 – WordPress GD Security Headers Plugin <= 1.7 is vulnerable to SQL Injection

https://notcve.org/view.php?id=CVE-2023-46821

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Milan Petrovic GD Security Headers allows auth. (admin+) SQL Injection.This issue affects GD Security Headers: from n/a through 1.7. La neutralización inadecuada de los elementos especiales utilizados en una vulnerabilidad de comando SQL ('inyección SQL') en Milan Petrovic GD Security Headers permite la autenticación. (con permisos de admin o superiores) Inyección SQL. Este problema afecta GD Security Headers: desde n/a hasta 1.7. • https://patchstack.com/database/vulnerability/gd-security-headers/wordpress-gd-security-headers-plugin-1-7-sql-injection-vulnerability?_s_id=cve • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 7.1EPSS: 0%CPEs: 1EXPL: 0

CVE-2023-40330 – WordPress GD Security Headers Plugin <= 1.6.1 is vulnerable to Cross Site Scripting (XSS)

https://notcve.org/view.php?id=CVE-2023-40330

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Milan Petrovic GD Security Headers plugin <= 1.6.1 versions. Vulnerabilidad de Cross-Site Scripting (XSS) Reflejada No Autenticada en el complemento Milan Petrovic GD Security Headers en versiones &lt;= 1.6.1. The GD Security Headers plugin for WordPress is vulnerable to Reflected Cross-Site Scripting via error message in versions up to, and including, 1.6.1 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/gd-security-headers/wordpress-gd-security-headers-plugin-1-6-1-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •