CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-37992 – WordPress Smarty for WordPress Plugin <= 3.1.35 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-37992
19 Jul 2023 — Cross-Site Request Forgery (CSRF) vulnerability in PressPage Entertainment Inc. Smarty for WordPress plugin <= 3.1.35 versions. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento Smarty de PressPage Entertainment Inc. para WordPress en versiones <= 3.1.35. The Smarty for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.1.35. This is due to missing or incorrect nonce validation on the displaySmartyManagementPage function... • https://patchstack.com/database/vulnerability/smarty-for-wordpress/wordpress-smarty-for-wordpress-plugin-3-1-35-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 9.8EPSS: 6%CPEs: 1EXPL: 1CVE-2022-0827 – Bestbooks <= 2.6.3 - Unauthenticated SQLi
https://notcve.org/view.php?id=CVE-2022-0827
17 May 2022 — The Bestbooks WordPress plugin through 2.6.3 does not sanitise and escape some parameters before using them in a SQL statement via an AJAX action, leading to an SQL Injection exploitable by unauthenticated users El plugin Bestbooks de WordPress versiones hasta 2.6.3, no sanea y escapa de algunos parámetros antes de usarlos en una sentencia SQL por medio de una acción AJAX, conllevando a una inyección SQL explotable por usuarios no autenticados • https://wpscan.com/vulnerability/0d208ebc-7805-457b-aa5f-ffd5adb2f3be • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •