Page 3 of 12 results (0.002 seconds)

CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2

CVE-2021-24786 – Download Monitor < 4.4.5 - Admin+ SQL Injection

https://notcve.org/view.php?id=CVE-2021-24786

The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue El plugin Download Monitor de WordPress versiones anteriores a 4.4.5, no comprueba ni escapa del parámetro GET "orderby" antes de usarlo en una sentencia SQL cuando son visualizados los registros, conllevando un problema de inyección SQL WordPress Download Monitor WordPress plugin versions prior to 4.4.5 suffer from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/50695 https://wpscan.com/vulnerability/a6571f16-66d2-449e-af83-1c6ddd56edfa • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •

CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3

CVE-2012-4768 – Download Monitor <= 3.3.5.8 - Reflected Cross-Site Scripting

https://notcve.org/view.php?id=CVE-2012-4768

Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI. Vulnerabilidad de XSS en el plugin Download Monitor anterior a 3.3.5.9 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro dlsearch en la URI por defecto. Wordpress Download Monitor version 3.3.5.7 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/37787 http://archives.neohapsis.com/archives/bugtraq/2012-09/0042.html http://osvdb.org/85319 http://packetstormsecurity.org/files/116408/wpdownloadmonitor3357-xss.txt http://secunia.com/advisories/50511 http://www.reactionpenetrationtesting.co.uk/wordpress-download-monitor-xss.html https://exchange.xforce.ibmcloud.com/vulnerabilities/78422 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •