CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-41801 – WordPress AWP Classifieds Plugin <= 4.3 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-41801
Cross-Site Request Forgery (CSRF) vulnerability in AWP Classifieds Team Ad Directory & Listings by AWP Classifieds plugin <= 4.3 versions. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento AWP Classifieds Team Ad Directory & Listings by AWP Classifieds en versiones <= 4.3. The AWP Classifieds plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 4.3. This is due to missing nonce validation on several functions such as dispatch(), try_to_delete_categories(), try_to_update_category(), try_to_move_categories(), and more. This makes it possible for unauthenticated attackers to manage categories via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://patchstack.com/database/vulnerability/another-wordpress-classifieds-plugin/wordpress-classifieds-plugin-ad-directory-listings-plugin-4-3-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 1CVE-2022-3254 – AWP Classifieds Plugin < 4.3 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2022-3254
The WordPress Classifieds Plugin WordPress plugin before 4.3 does not properly sanitise and escape some parameters before using them in a SQL statement via an AJAX action available to unauthenticated users and when a specific premium module is active, leading to a SQL injection El complemento de anuncios clasificados de WordPress El complemento de WordPress anterior a 4.3 no sanitiza y escapa adecuadamente algunos parámetros antes de usarlos en una declaración SQL a través de una acción AJAX disponible para usuarios no autenticados y cuando un módulo premium específico está activo, lo que lleva a una inyección de SQL. The AWP Classifieds plugin for WordPress is vulnerable to SQL Injection via an unknown parameter in versions up to, and including, 4.2.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://wpscan.com/vulnerability/546c47c2-5b4b-46db-b754-c6b43aef2660 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 3CVE-2014-10013 – WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds < 3.0 - SQL Injection
https://notcve.org/view.php?id=CVE-2014-10013
SQL injection vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to execute arbitrary SQL commands via the keywordphrase parameter in a dosearch action. Vulnerabilidad de inyección SQL en el plugin Another WordPress Classifieds Plugin para WordPress permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro keywordphrase en una acción dosearch. • https://www.exploit-db.com/exploits/35204 http://packetstormsecurity.com/files/129035/Another-WordPress-Classifieds-Cross-Site-Scripting-SQL-Injection.html http://www.exploit-db.com/exploits/35204 https://exchange.xforce.ibmcloud.com/vulnerabilities/98589 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2014-10012 – WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds < 3.0 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-10012
Cross-site scripting (XSS) vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI. Vulnerabilidad de XSS en el plugin Another WordPress Classifieds Plugin para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de la cadena de consulta en la URI por defecto. • http://packetstormsecurity.com/files/129035/Another-WordPress-Classifieds-Cross-Site-Scripting-SQL-Injection.html https://exchange.xforce.ibmcloud.com/vulnerabilities/98588 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2012-4874 – WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds < 2.0 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2012-4874
Unspecified vulnerability in the Another WordPress Classifieds Plugin before 2.0 for WordPress has unknown impact and attack vectors related to "image uploads." Vulnerabilidad no especificada en el plugin Another WordPress Classifieds anterior a v2.0 tiene un impacto desconocido y vectores de ataque similares a "archivos de imagen." The WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the admin_handleimagesupload function in versions up to, and including, 1.8.9.4. This makes it possible for authenticated attackers, with administrator-level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible. • http://osvdb.org/80881 http://secunia.com/advisories/47335 http://wordpress.org/extend/plugins/another-wordpress-classifieds-plugin/changelog http://www.securityfocus.com/bid/52861 • CWE-434: Unrestricted Upload of File with Dangerous Type •