CVSS: 7.2EPSS: 0%CPEs: 1EXPL: 2CVE-2021-24786 – Download Monitor < 4.4.5 - Admin+ SQL Injection
https://notcve.org/view.php?id=CVE-2021-24786
The Download Monitor WordPress plugin before 4.4.5 does not properly validate and escape the "orderby" GET parameter before using it in a SQL statement when viewing the logs, leading to an SQL Injection issue El plugin Download Monitor de WordPress versiones anteriores a 4.4.5, no comprueba ni escapa del parámetro GET "orderby" antes de usarlo en una sentencia SQL cuando son visualizados los registros, conllevando un problema de inyección SQL WordPress Download Monitor WordPress plugin versions prior to 4.4.5 suffer from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/50695 https://wpscan.com/vulnerability/a6571f16-66d2-449e-af83-1c6ddd56edfa • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2015-9296 – Download Monitor < 1.7.1 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-9296
The download-monitor plugin before 1.7.1 for WordPress has XSS related to add_query_arg. El complemento download-monitor versiones anteriores a 1.7.1 para WordPress tiene XSS relacionado con add_query_arg • https://wordpress.org/plugins/download-monitor/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 8EXPL: 0CVE-2013-5098 – Download Monitor < 3.3.6.2 - Cross-Site Scripting via sort Parameter
https://notcve.org/view.php?id=CVE-2013-5098
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262. Vulnerabilidad Cross-site scripting (XSS) en admin/admin.php en el plugin Download Monitor anterior a v3.3.6.2 para WordPress, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro “sort”, una vulnerabilidad diferente de CVE-2013-3262. • http://plugins.trac.wordpress.org/changeset/723187/download-monitor http://secunia.com/advisories/53116 http://www.securityfocus.com/bid/61407 https://exchange.xforce.ibmcloud.com/vulnerabilities/85921 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 8EXPL: 1CVE-2013-3262 – Download Monitor < 3.3.6.2 - Cross-Site Scripting via p Parameter
https://notcve.org/view.php?id=CVE-2013-3262
Cross-site scripting (XSS) vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter. Vulnerabilidad Cross-site scripting (XSS) en admin/admin.php en el plugin Download Monitor anterior a v3.3.6.2 para WordPress, permite a atacantes remotos inyectar secuencias de comandos web o HTML a través del parámetro “p”. • http://plugins.trac.wordpress.org/changeset/723187/download-monitor http://secunia.com/advisories/53116 http://www.securityfocus.com/bid/61407 https://exchange.xforce.ibmcloud.com/vulnerabilities/85921 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 3CVE-2012-4768 – Download Monitor <= 3.3.5.8 - Reflected Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-4768
Cross-site scripting (XSS) vulnerability in the Download Monitor plugin before 3.3.5.9 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dlsearch parameter to the default URI. Vulnerabilidad de XSS en el plugin Download Monitor anterior a 3.3.5.9 para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través del parámetro dlsearch en la URI por defecto. Wordpress Download Monitor version 3.3.5.7 suffers from a cross site scripting vulnerability. • https://www.exploit-db.com/exploits/37787 http://archives.neohapsis.com/archives/bugtraq/2012-09/0042.html http://osvdb.org/85319 http://packetstormsecurity.org/files/116408/wpdownloadmonitor3357-xss.txt http://secunia.com/advisories/50511 http://www.reactionpenetrationtesting.co.uk/wordpress-download-monitor-xss.html https://exchange.xforce.ibmcloud.com/vulnerabilities/78422 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •