CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2021-24892 – Advanced Forms < 1.6.9 - Subscriber+ Arbitrary User Email Address Update via IDOR
https://notcve.org/view.php?id=CVE-2021-24892
Insecure Direct Object Reference in edit function of Advanced Forms (Free & Pro) before 1.6.9 allows authenticated remote attacker to change arbitrary user's email address and request for reset password, which could lead to take over of WordPress's administrator account. To exploit this vulnerability, an attacker must register to obtain a valid WordPress's user and use such user to authenticate with WordPress in order to exploit the vulnerable edit function. Una Referencia Directa a Objetos no Segura en la función edit de Advanced Forms (Free & Pro) versiones anteriores a 1.6.9, permite a un atacante remoto autenticado cambiar la dirección de correo electrónico de un usuario arbitrario y solicitar el restablecimiento de la contraseña, que podría conllevar a una toma de control de la cuenta de administrador de WordPress. Para explotar esta vulnerabilidad, un atacante debe registrarse para obtener un usuario válido de WordPress y usar dicho usuario para autenticarse con WordPress con el fin de explotar la función edit vulnerable • https://github.com/advancedforms/advanced-forms/commit/2ce3ab6985c3a909eefb01c562995bc6a994d3a2 https://wpscan.com/vulnerability/364b0843-a990-4204-848a-60c928cc5bc0 • CWE-639: Authorization Bypass Through User-Controlled Key •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-16015
https://notcve.org/view.php?id=CVE-2017-16015
Forms is a library for easily creating HTML forms. Versions before 1.3.0 did not have proper html escaping. This means that if the application did not sanitize html on behalf of forms, use of forms may be vulnerable to cross site scripting Forms es una biblioteca para crear formularios HTML fácilmente. Las versiones anteriores a la 1.3.0 no contaban con un escapado HTML adecuado. Esto significa que, si la aplicación no saneaba código html en representación de los formularios, su uso podría ser vulnerable a Cross-Site Scripting (XSS). • https://github.com/caolan/forms/commit/bc01e534a0ff863dedb2026a50bd03153bbc6a5d https://nodesecurity.io/advisories/158 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 0CVE-2018-20988 – Google Forms <= 0.93 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2018-20988
The wpgform plugin before 0.94 for WordPress has eval injection in the CAPTCHA calculation. El complemento wpgform en versiones anteriores a 0.94 para WordPress tiene inyección eval en el cálculo CAPTCHA. • https://wordpress.org/plugins/wpgform/#developers • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.8EPSS: 8%CPEs: 1EXPL: 1CVE-2018-10063 – Joomla! Convert Forms version 2.0.3 - Formula Injection (CSV Injection)
https://notcve.org/view.php?id=CVE-2018-10063
The Convert Forms extension before 2.0.4 for Joomla! is vulnerable to Remote Command Execution using CSV Injection that is mishandled when exporting a Leads file. La extensión Convert Forms, en versiones anteriores a la 2.0.4 para Joomla!, es vulnerable a la ejecución remota de comandos empleando una inyección CSV que se gestiona de manera incorrecta al exportar un archivo Leads. Joomla Convert Forms extension version 2.0.3 suffers from a CSV formula injection vulnerability. • https://www.exploit-db.com/exploits/44447 https://extensions.joomla.org/extensions/extension/contacts-and-feedback/forms/convert-forms https://www.tassos.gr/blog/convert-forms-2-0-4-security-release •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2017-1000033 – Vospari Forms < 1.4 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-1000033
Wordpress Plugin Vospari Forms version < 1.4 is vulnerable to a reflected cross site scripting in the form submission resulting in javascript code execution in the context on the current user. Wordpress Plugin Vospari Forms versión anterior a 1.4, es vulnerable a un ataque de tipo cross site scripting reflejado en la entrega de formulario resultando en la ejecución de código javascript en el contexto del usuario actual. • https://cjc.im/advisories/0007 https://wpvulndb.com/vulnerabilities/8862 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •