CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-50489 – WordPress Realty Workstation plugin <= 1.0.45 - Account Takeover vulnerability
https://notcve.org/view.php?id=CVE-2024-50489
Authentication Bypass Using an Alternate Path or Channel vulnerability in Realty Workstation allows Authentication Bypass.This issue affects Realty Workstation: from n/a through 1.0.45. The Realty Workstation plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 1.0.45. This is due to the plugin not properly verifying a users identify prior to allowing them to access an account. This makes it possible for unauthenticated attackers to log in as other users, such as administrators. • https://patchstack.com/database/vulnerability/realty-workstation/wordpress-realty-workstation-plugin-1-0-45-account-takeover-vulnerability?_s_id=cve • CWE-288: Authentication Bypass Using an Alternate Path or Channel •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 2CVE-2022-1691 – Realty Workstation < 1.0.15 - Agent SQLi
https://notcve.org/view.php?id=CVE-2022-1691
The Realty Workstation WordPress plugin before 1.0.15 does not sanitise and escape the trans_edit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injection El plugin Realty Workstation WordPress antes de la versión 1.0.15 no sanea y escapa del parámetro trans_edit antes de utilizarlo en una sentencia SQL cuando un agente edita una transacción, lo que lleva a una inyección SQL The Realty Workstation WordPress plugin through 1.0.9 does not sanitise and escape the trans_edit parameter before using it in a SQL statement when an agent edit a transaction, leading to an SQL injection • https://bulletin.iese.de/post/realty-workstation_1-0-6 https://wpscan.com/vulnerability/f9363b4c-c434-4f15-93f8-46162d2d7049 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •