CVSS: 7.6EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47530 – WordPress Redirect 404 Error Page to Homepage or Custom Page with Logs Plugin <= 1.8.7 is vulnerable to SQL Injection
https://notcve.org/view.php?id=CVE-2023-47530
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs allows SQL Injection.This issue affects Redirect 404 Error Page to Homepage or Custom Page with Logs: from n/a through 1.8.7. La neutralización incorrecta de elementos especiales utilizados en una vulnerabilidad de comando SQL ('inyección SQL') en WPVibes Redirect 404 Error Page to Homepage or Custom Page with Logs permite la inyección de SQL. Este problema afecta a Redirect 404 Error Page to Homepage or Custom Page with Logs: de n/a hasta 1.8.7. The Redirect 404 Error Page to Homepage or Custom Page with Logs plugin for WordPress is vulnerable to SQL Injection in versions up to, and including, 1.8.7 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers, with administrator-level access and above, to append additional SQL queries into already existing queries that can be used to extract sensitive information from the database. • https://patchstack.com/database/vulnerability/redirect-404-error-page-to-homepage-or-custom-page/wordpress-redirect-404-error-page-to-homepage-or-custom-page-with-logs-plugin-1-8-7-sql-injection-vulnerability?_s_id=cve • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-24767 – Redirect 404 Error Page to Homepage or Custom Page with Logs < 1.7.9 - Log Deletion via CSRF
https://notcve.org/view.php?id=CVE-2021-24767
The Redirect 404 Error Page to Homepage or Custom Page with Logs WordPress plugin before 1.7.9 does not check for CSRF when deleting logs, which could allow attacker to make a logged in admin delete them via a CSRF attack El plugin Redirect 404 Error Page to Homepage or Custom Page with Logs de WordPress versiones anteriores a 1.7.9, no comprueba la existencia de CSRF cuando se borran los registros, lo que podría permitir a un atacante hacer que un administrador conectado los borre por medio de un ataque de tipo CSRF • https://wpscan.com/vulnerability/0b35ad4a-3d94-49b1-a98d-07acf8dd4962 • CWE-352: Cross-Site Request Forgery (CSRF) •