CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0216 – Google Doc Embedder <= 2.6.4 - Authenticated (Contributor+) Blind Server Side Request Forgery
https://notcve.org/view.php?id=CVE-2024-0216
The Google Doc Embedder plugin for WordPress is vulnerable to Server Side Request Forgery via the 'gview' shortcode in versions up to, and including, 2.6.4. This can allow authenticated attackers with contributor-level permissions or above to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. El complemento Google Doc Embedder para WordPress es vulnerable a Server Side Request Forgery a través del código abreviado 'gview' en versiones hasta la 2.6.4 incluida. Esto puede permitir a atacantes autenticados con permisos de nivel de colaborador o superior realizar solicitudes web a ubicaciones arbitrarias que se originen en la aplicación web y puede usarse para consultar y modificar información de servicios internos. • https://plugins.trac.wordpress.org/browser/google-document-embedder/tags/2.6.4/functions.php#L187 https://www.wordfence.com/threat-intel/vulnerabilities/id/75e55138-b091-4113-89da-e1ca45fb99ea?source=cve • CWE-918: Server-Side Request Forgery (SSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10881 – Google Doc Embedder <= 2.6.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10881
The google-document-embedder plugin before 2.6.2 for WordPress has XSS. El plugin google-document-embedder versiones anteriores a 2.6.2 para WordPress, presenta una vulnerabilidad de tipo XSS. • https://wordpress.org/plugins/google-document-embedder/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.8EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10882 – Google Doc Embedder <= 2.6.1 - Cross-Site Request Forgery
https://notcve.org/view.php?id=CVE-2016-10882
The google-document-embedder plugin before 2.6.2 for WordPress has CSRF. El plugin google-document-embedder versiones anteriores a 2.6.2 para WordPress, presenta una vulnerabilidad de tipo CSRF. The Google Doc Embedder plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.6.1. This makes it possible for unauthenticated attackers to conduct attacks such as cross-site scripting via forged request granted they can trick a site administrator into performing an action such as clicking on a link. • https://wordpress.org/plugins/google-document-embedder/#developers • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 0CVE-2016-10880 – Google Doc Embedder <= 2.6 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2016-10880
The google-document-embedder plugin before 2.6.1 for WordPress has XSS. El plugin google-document-embedder versiones anteriores a 2.6.1 para WordPress, presenta una vulnerabilidad de tipo XSS. • https://wordpress.org/plugins/google-document-embedder/#developers • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 5CVE-2014-9173 – Google Doc Embedder < 2.5.17 - SQL Injection
https://notcve.org/view.php?id=CVE-2014-9173
SQL injection vulnerability in view.php in the Google Doc Embedder plugin before 2.5.15 for WordPress allows remote attackers to execute arbitrary SQL commands via the gpid parameter. Vulnerabilidad de inyección SQL en view.php en el plugin Google Doc Embedder anterior a 2.5.15 para WordPress permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro gpid. • https://www.exploit-db.com/exploits/35447 https://www.exploit-db.com/exploits/35371 http://osvdb.org/show/osvdb/115044 http://security.szurek.pl/google-doc-embedder-2514-sql-injection.html http://www.exploit-db.com/exploits/35371 https://exchange.xforce.ibmcloud.com/vulnerabilities/98944 https://plugins.trac.wordpress.org/changeset/1023572/google-document-embedder • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •