CVSS: 5.3EPSS: %CPEs: 1EXPL: 0CVE-2024-7762 – Simple Job Board <= 2.12.5 - Unauthenticated Resumes Download
https://notcve.org/view.php?id=CVE-2024-7762
13 Sep 2024 — The Simple Job Board plugin for WordPress is vulnerable to Sensitive Information Exposure in versions up to, and including, 2.12.5 due to insufficient access controls placed on the 'wp-content/uploads/jobpost/[YEAR]' directory. This makes it possible for unauthenticated attackers to download potentially sensitive resume information. • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 8.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7351 – Simple Job Board <= 2.12.3 - Authenticated (Editor+) PHP Object Injection
https://notcve.org/view.php?id=CVE-2024-7351
23 Aug 2024 — The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.12.3 via deserialization of untrusted input when editing job applications. This makes it possible for authenticated attackers, with Editor-level access and above, to inject a PHP Object. No known POP chain is present in the vulnerable software. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, ... • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3138348%40simple-job-board%2Ftrunk&old=3113171%40simple-job-board%2Ftrunk&sfp_email=&sfph_mail=#file12 • CWE-502: Deserialization of Untrusted Data •
CVSS: 4.4EPSS: 0%CPEs: 1EXPL: 0CVE-2024-7761 – Simple Job Board <= 2.12.1 - Authenticated (Administrator+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2024-7761
04 Jul 2024 — The Simple Job Board plugin for WordPress is vulnerable to Stored Cross-Site Scripting via admin settings in all versions up to, and including, 2.12.1 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with administrator-level permissions and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This only affects multi-site installations and installations where unfiltered_html has been disable... • CWE-80: Improper Neutralization of Script-Related HTML Tags in a Web Page (Basic XSS) •
CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2024-1813 – Simple Job Board <= 2.11.0 - Unauthenticated PHP Object Injection via Job Application Fields
https://notcve.org/view.php?id=CVE-2024-1813
15 Mar 2024 — The Simple Job Board plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 2.11.0 via deserialization of untrusted input in the job_board_applicant_list_columns_value function. This makes it possible for unauthenticated attackers to inject a PHP Object. If a POP chain is present via an additional plugin or theme installed on the target system, it could allow the attacker to delete arbitrary files, retrieve sensitive data, or execute code when a submitted job applic... • https://plugins.trac.wordpress.org/changeset?sfp_email=&sfph_mail=&reponame=&new=3051715%40simple-job-board&old=3038476%40simple-job-board&sfp_email=&sfph_mail= • CWE-502: Deserialization of Untrusted Data •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2024-0593 – Simple Job Board <= 2.10.8 - Missing Authorization to Unauthenticated Information Disclosure
https://notcve.org/view.php?id=CVE-2024-0593
20 Feb 2024 — The Simple Job Board plugin for WordPress is vulnerable to unauthorized access of data| due to insufficient authorization checking on the fetch_quick_job() function in all versions up to, and including, 2.10.8. This makes it possible for unauthenticated attackers to fetch arbitrary posts, which can be password protected or private and contain sensitive information. El complemento Simple Job Board para WordPress es vulnerable al acceso no autorizado a los datos | debido a una verificación de autorización ins... • https://plugins.trac.wordpress.org/changeset/3038476/simple-job-board/trunk/includes/class-simple-job-board-ajax.php • CWE-862: Missing Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-52122 – WordPress Simple Job Board Plugin <= 2.10.6 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-52122
28 Dec 2023 — Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board.This issue affects Simple Job Board: from n/a through 2.10.6. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en PressTigers Simple Job Board. Este problema afecta a Simple Job Board: desde n/a hasta 2.10.6. The Simple Job Board plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 2.10.6. This is due to missing or incorrect nonce validation on an unknown function. • https://patchstack.com/database/vulnerability/simple-job-board/wordpress-simple-job-board-plugin-2-10-6-cross-site-request-forgery-csrf-vulnerability?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 5.8EPSS: 0%CPEs: 1EXPL: 0CVE-2023-47188 – WordPress Simple Job Board plugin <= 2.10.5 - Broken Access Control vulnerability
https://notcve.org/view.php?id=CVE-2023-47188
03 Nov 2023 — Missing Authorization vulnerability in PressTigers Simple Job Board allows Exploiting Incorrectly Configured Access Control Security Levels.This issue affects Simple Job Board: from n/a through 2.10.5. The Simple Job Board plugin for WordPress is vulnerable to unauthorized access due to a missing capability check on a function in all versions up to, and including, 2.10.5. This makes it possible for unauthenticated attackers to perform an unauthorized action. • https://patchstack.com/database/wordpress/plugin/simple-job-board/vulnerability/wordpress-simple-job-board-plugin-2-10-5-broken-access-control-vulnerability?_s_id=cve • CWE-862: Missing Authorization •
CVSS: 10.0EPSS: 0%CPEs: 1EXPL: 0CVE-2023-29440 – WordPress Simple Job Board Plugin <= 2.10.3 is vulnerable to Cross Site Request Forgery (CSRF)
https://notcve.org/view.php?id=CVE-2023-29440
07 Apr 2023 — Cross-Site Request Forgery (CSRF) vulnerability in PressTigers Simple Job Board plugin <= 2.10.3 versions. Vulnerabilidad de Cross-Site Request Forgery (CSRF) en el complemento PressTigers Simple Job Board en versiones <= 2.10.3. The Simple Job Board plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 2.10.3. This is due to missing or incorrect nonce validation on the sjb_save_settings_section function. This makes it possible for unauthenticated attackers to... • https://patchstack.com/database/vulnerability/simple-job-board/wordpress-simple-job-board-plugin-2-10-3-cross-site-request-forgery-csrf?_s_id=cve • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2022-2558 – Simple Job Board < 2.10.0 - Resume Disclosure via Directory Listing
https://notcve.org/view.php?id=CVE-2022-2558
01 Aug 2022 — The Simple Job Board WordPress plugin before 2.10.0 is susceptible to Directory Listing which allows the public listing of uploaded resumes in certain configurations. El plugin Simple Job Board de WordPress versiones anteriores a 2.10.0, es susceptible de ser listado en el directorio, lo que permite el listado público de los currículos subidos en determinadas configuraciones. The plugin Simple Job Board for WordPress is vulnerable to Information Disclosure in versions up to, and including, 2.9.6. This makes... • https://wpscan.com/vulnerability/6e096269-eedc-4614-88ce-6795c4adf32f • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 5.5EPSS: 0%CPEs: 1EXPL: 1CVE-2021-39328 – Simple Job Board <= 2.9.4 Authenticated Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2021-39328
21 Oct 2021 — The Simple Job Board WordPress plugin is vulnerable to Stored Cross-Site Scripting due to insufficient escaping on the $job_board_privacy_policy_label variable echo'd out via the ~/admin/settings/class-simple-job-board-settings-privacy.php file which allowed attackers with administrative user access to inject arbitrary web scripts, in versions up to and including 2.9.4. This affects multi-site installations where unfiltered_html is disabled for administrators, and sites where unfiltered_html is disabled. El... • https://github.com/BigTiger2020/word-press/blob/main/Simple%20Job%20Board%E2%80%94Stored%20Cross-Site%20Scripting%20-%202.md • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •