CVSS: 4.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19110 – wpForo Forum <= 1.6.5 - Cross-Site Scripting via s parameter
https://notcve.org/view.php?id=CVE-2019-19110
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter. El plugin wpForo versión 1.6.5 para WordPress, permite un ataque de tipo XSS por medio del parámetro s de wp-admin/admin.php?page=wpforo-expressions • https://twitter.com/Sh0ckFR/status/1257298443527053313 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19109 – wpForo Forum <= 1.6.5 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2019-19109
The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF. El plugin wpForo versión 1.6.5 para WordPress, permite un ataque de tipo CSRF de wp-admin/admin.php?page=wpforo-usergroups • https://twitter.com/Sh0ckFR/status/1257298443527053313 • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2019-19111 – wpForo Forum <= 1.6.5 - Cross-Site Scripting via langid parameter
https://notcve.org/view.php?id=CVE-2019-19111
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter. El plugin wpForo versión 1.6.5 para WordPress, permite un ataque de tipo XSS por medio del parámetro langid de wp-admin/admin.php?page=wpforo-expressions • https://twitter.com/Sh0ckFR/status/1257298443527053313 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2018-11515 – wpForo Forum <= 1.4.12 - SQL Injection
https://notcve.org/view.php?id=CVE-2018-11515
The wpForo plugin through 2018-02-05 for WordPress has SQL Injection via a search with the /forum/ wpfo parameter. Se ha descubierto un problema en Moodle 3.x. Los estudiantes que enviaban tareas y las exportaban a portfolios podían descargar cualquier archivo Moodle cambiando la URL de descarga. The wpForo Forum plugin for WordPress is vulnerable to Blind SQL Injection via the ‘wpfo’ parameter in versions up to, and including, 1.4.12 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://github.com/DediData/wpforo/issues/1 https://wpvulndb.com/vulnerabilities/9089 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •