CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2558 – Simple Job Board < 2.10.0 - Resume Disclosure via Directory Listing
https://notcve.org/view.php?id=CVE-2022-2558
The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations. El plugin Simple Job Board de WordPress versiones anteriores a 2.10.0, es susceptible de ser listado en el directorio, lo que permite el listado público de los currículos subidos en determinadas configuraciones. The plugin Simple Job Board for WordPress is vulnerable to Information Disclosure in versions up to, and including, 2.9.6. This makes it possible for attackers do extract sensitive information such as resumes. • https://wpscan.com/vulnerability/6e096269-eedc-4614-88ce-6795c4adf32f • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-39328 – Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-39328
The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. El plugin Simple Job Board de WordPress es vulnerable a un ataque de tipo Cross-Site Scripting Almacenado debido a un escape insuficiente en la variable $job_board_privacy_policy_label que se hace eco por medio del archivo ~/admin/settings/class-simple-job-board-settings-privacy.php que permite a atacantes con acceso de usuario administrativo inyectar scripts web arbitrarios, en versiones hasta la 2.9.4 incluyéndola. Esto afecta a las instalaciones multisitio donde unfiltered_html está deshabilitado para los administradores, y los sitios donde unfiltered_html está deshabilitado • https://github.com/BigTiger2020/word-press/blob/main/Simple%20Job%20Board%E2%80%94Stored%20Cross-Site%20Scripting%20-%202.md https://plugins.trac.wordpress.org/changeset/2617364/simple-job-board/trunk/admin/settings/class-simple-job-board-settings-privacy.php https://www.wordfence.com/vulnerability-advisories/#CVE-2021-39328 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.7EPSS: 12%CPEs: 1EXPL: 6CVE-2020-35749 – Simple Job Board <= 2.9.3 - Local File Inclusion
https://notcve.org/view.php?id=CVE-2020-35749
Directory traversal vulnerability in class-simple_job_board_resume_download_handler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjb_file parameter to wp-admin/post.php. Una vulnerabilidad de salto de directorio en el archivo class-simple_job_board_resume_download_handler.php en el plugin Simple Board Job versiones 2.9.3 y anteriores para WordPress, permite a atacantes remotos leer archivos arbitrarios por medio del parámetro sjb_file en el archivo wp-admin/post.php WordPress Simple Job Board plugin version 2.9.3 suffers from a local file inclusion vulnerability. • https://www.exploit-db.com/exploits/49450 https://www.exploit-db.com/exploits/50721 https://github.com/M4xSec/Wordpress-CVE-2020-35749 http://packetstormsecurity.com/files/161050/Simple-JobBoard-Authenticated-File-Read.html http://packetstormsecurity.com/files/165892/WordPress-Simple-Job-Board-2.9.3-Local-File-Inclusion.html https://docs.google.com/document/d/1TbePkrRGsczepBaJptIdVRvfRrjiC5hjGg_Vxdesw6E/edit?usp=sharing • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2017-18498 – Simple Job Board <= 2.4.4 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2017-18498
The simple-job-board plugin before 2.4.4 for WordPress has reflected XSS via keyword search. El complemento the simple-job-board anterior de 2.4.4 para WordPress ha reflejado XSS a través de la búsqueda de palabras clave. • https://wordpress.org/plugins/simple-job-board/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •