CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7351 – Simple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection
https://notcve.org/view.php?id=CVE-2024-7351
23 Aug 2024 — The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, ... • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3138348%40simple-job-board%2Ftrunk&old=3113171%40simple-job-board%2Ftrunk&sfp_email=&sfph_mail=#file12 • CWE-502: Deserialization of Untrusted Data •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1813 – Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields
https://notcve.org/view.php?id=CVE-2024-1813
15 Mar 2024 — The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code when a submitted job applic... • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3051715%40simple-job-board&old=3038476%40simple-job-board&sfp_email=&sfph_mail= • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0593 – Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure
https://notcve.org/view.php?id=CVE-2024-0593
20 Feb 2024 — The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() function in all versions up to, and including, 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information. El complemento Simple Job Board para WordPress es vulnerable al acceso no autorizado a los datos | debido a una verificación de autorización ins... • https://plugins.trac.wordpress.org/changeset/3038476/simple-job-board/trunk/includes/class-simple-job-board-ajax.php • CWE-862: Missing Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-52122 – WordPress Simple Job Board Plugin <= 2.10.6 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-52122
28 Dec 2023 — Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en PressTigers Simple Job Board. Este problema afecta a Simple Job Board: desde n/a hasta 2.10.6. The Simple Job Board plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.6. This is due to missing or incorrect nonce validation on an unknown function. • https://patchstack.com/database/vulnerability/simple-job-board/wordpress-simple-job-board-plugin-2-10-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-29440 – WordPress Simple Job Board Plugin <= 2.10.3 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-29440
07 Apr 2023 — Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento PressTigers Simple Job Board en versiones <= 2.10.3. The Simple Job Board plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.3. This is due to missing or incorrect nonce validation on the sjb_save_settings_section function. This makes it possible for unauthenticated attackers to... • https://patchstack.com/database/vulnerability/simple-job-board/wordpress-simple-job-board-plugin-2-10-3-cross-site-request-forgery-csrf?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2558 – Simple Job Board < 2.10.0 - Resume Disclosure via Directory Listing
https://notcve.org/view.php?id=CVE-2022-2558
01 Aug 2022 — The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations. El plugin Simple Job Board de WordPress versiones anteriores a 2.10.0, es susceptible de ser listado en el directorio, lo que permite el listado público de los currículos subidos en determinadas configuraciones. The plugin Simple Job Board for WordPress is vulnerable to Information Disclosure in versions up to, and including, 2.9.6. This makes... • https://wpscan.com/vulnerability/6e096269-eedc-4614-88ce-6795c4adf32f • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-39328 – Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-39328
21 Oct 2021 — The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. El... • https://github.com/BigTiger2020/word-press/blob/main/Simple%20Job%20Board%E2%80%94Stored%20Cross-Site%20Scripting%20-%202.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.7EPSS: 39%CPEs: 1EXPL: 6CVE-2020-35749 – Simple Job Board <= 2.9.3 - Local File Inclusion
https://notcve.org/view.php?id=CVE-2020-35749
15 Jan 2021 — Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjb_file parameter to wp-admin/post.php. Una vulnerabilidad de salto de directorio en el archivo class-simple_job_board_resume_download_handler.php en el plugin Simple Board Job versiones 2.9.3 y anteriores para WordPress, permite a atacantes remotos leer archivos arbitrarios por medio del parámetro sjb_... • https://www.exploit-db.com/exploits/49450 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18498 – Simple Job Board <= 2.4.4 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-18498
19 Apr 2017 — The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search. El complemento the simple-job-board anterior de 2.4.4 para WordPress ha reflejado XSS a través de la búsqueda de palabras clave. • https://wordpress.org/plugins/simple-job-board/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •