CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 0CVE-2024-51786 – WordPress Realty by BestWebSoft plugin <= 1.1.5 - Cross Site Scripting (XSS) vulnerability
https://notcve.org/view.php?id=CVE-2024-51786
Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in BestWebSoft Realty by BestWebSoft allows Stored XSS.This issue affects Realty by BestWebSoft: from n/a through 1.1.5. The Realty by BestWebSoft plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 1.1.5 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. • https://patchstack.com/database/vulnerability/realty/wordpress-realty-by-bestwebsoft-plugin-1-1-5-cross-site-scripting-xss-vulnerability?_s_id=cve • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-50489 – WordPress Realty Workstation plugin <= 1.0.45 - Account Takeover vulnerability
https://notcve.org/view.php?id=CVE-2024-50489
Authentication Bypass Using an Alternate Path or Channel vulnerability in Realty Workstation allows Authentication Bypass.This issue affects Realty Workstation: from n/a through 1.0.45. The Realty Workstation plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.0.45. This is due to the plugin not properly verifying a users identify prior to allowing them to access an account. This makes it possible for unauthenticated attackers to log in as other users, such as administrators. • https://patchstack.com/database/vulnerability/realty-workstation/wordpress-realty-workstation-plugin-1-0-45-account-takeover-vulnerability?_s_id=cve • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 6.8EPSS: 1%CPEs: 3EXPL: 6CVE-2012-1112 – Open Realty 2.5.x - 'select_users_template' Local File Inclusion
https://notcve.org/view.php?id=CVE-2012-1112
Directory traversal vulnerability in Open-Realty CMS 2.5.8 and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the select_users_template parameter to index.php. Vulnerabilidad de directorio transversal en Open-Realty CMS v2.5.8 y anteriores permite a atacantes remotos incluir y ejecutar archivos locales a través de un .. (punto punto) en el parámetro select_users_template a index.php. • https://www.exploit-db.com/exploits/36910 http://archives.neohapsis.com/archives/bugtraq/2012-03/0012.html http://www.openwall.com/lists/oss-security/2012/03/05/14 http://www.openwall.com/lists/oss-security/2012/03/05/23 http://www.securityfocus.com/bid/52296 http://yehg.net/lab/pr0js/advisories/%5Bopen-realty_2.5.8_2.x%5D_lfi https://exchange.xforce.ibmcloud.com/vulnerabilities/73736 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 5.0EPSS: 0%CPEs: 1EXPL: 0CVE-2011-3765
https://notcve.org/view.php?id=CVE-2011-3765
Open-Realty 2.5.8 allows remote attackers to obtain sensitive information via a direct request to a .php file, which reveals the installation path in an error message, as demonstrated by install/versions/upgrade_115.inc.php and certain other files. Open-Realty v2.5.8 permite a atacantes remotos obtener información sensible a través de una petición directa a un archivo .php, lo que revela la ruta de instalación en un mensaje de error, como se demostró con install/versions/upgrade_115.inc.php y algunos otros archivos. • http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/%21_README http://code.google.com/p/inspathx/source/browse/trunk/paths_vuln/open-realty-2.5.8 http://www.openwall.com/lists/oss-security/2011/06/27/6 https://exchange.xforce.ibmcloud.com/vulnerabilities/70607 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 6.8EPSS: 69%CPEs: 6EXPL: 6CVE-2007-5056 – CMS Made Simple 1.2 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2007-5056
Eval injection vulnerability in adodb-perf-module.inc.php in ADOdb Lite 1.42 and earlier, as used in products including CMS Made Simple, SAPID CMF, Journalness, PacerCMS, and Open-Realty, allows remote attackers to execute arbitrary code via PHP sequences in the last_module parameter. Una vulnerabilidad de inyección Eval en el archivo adodb-perf-module.inc.php en ADOdb Lite versiones 1.42 y anteriores, como es usado en productos como CMS Made Simple, SAPID CMF, Journalness, PacerCMS y Open-Realty, permite a atacantes remotos ejecutar código arbitrario por medio de secuencias PHP en el parámetro last_module. • https://www.exploit-db.com/exploits/4442 https://www.exploit-db.com/exploits/5091 https://www.exploit-db.com/exploits/5090 https://www.exploit-db.com/exploits/5098 https://www.exploit-db.com/exploits/5097 http://osvdb.org/40596 http://osvdb.org/41422 http://osvdb.org/41426 http://osvdb.org/41427 http://osvdb.org/41428 http://secunia.com/advisories/26928 http://secunia.com/advisories/28859 http://secunia.com/advisories/28873 http://secunia.com/ • CWE-94: Improper Control of Generation of Code ('Code Injection') •