Show filters
18 Total Results
Displaying 11-18 of 18
Sort by:
Attacker Value
Unknown
CVE-2021-4339
Disclosure Date: June 07, 2023 (last updated October 08, 2023)
The uListing plugin for WordPress is vulnerable to authorization bypass due to a missing capability check in the "ulisting/includes/route.php" file on the /1/api/ulisting-user/search REST-API route in versions up to, and including, 1.6.6. This makes it possible for unauthenticated attackers to retrieve the list of all users and their email address in the database.
0
Attacker Value
Unknown
CVE-2021-36879
Disclosure Date: July 27, 2021 (last updated February 23, 2025)
Unauthenticated Privilege Escalation vulnerability in WordPress uListing plugin (versions <= 2.0.5). Possible if WordPress configuration allows user registration.
0
Attacker Value
Unknown
CVE-2021-36878
Disclosure Date: July 27, 2021 (last updated February 23, 2025)
Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to update settings.
0
Attacker Value
Unknown
CVE-2021-36877
Disclosure Date: July 27, 2021 (last updated February 23, 2025)
Cross-Site Request Forgery (CSRF) vulnerability in WordPress uListing plugin (versions <= 2.0.5) makes it possible for attackers to modify user roles.
0
Attacker Value
Unknown
CVE-2021-36876
Disclosure Date: July 27, 2021 (last updated February 23, 2025)
Multiple Cross-Site Request Forgery (CSRF) vulnerabilities in WordPress uListing plugin (versions <= 2.0.5) as it lacks CSRF checks on plugin administration pages.
0
Attacker Value
Unknown
CVE-2021-36875
Disclosure Date: July 27, 2021 (last updated February 23, 2025)
Authenticated Reflected Cross-Site Scripting (XSS) vulnerability in WordPress uListing plugin (versions <= 2.0.5). Vulnerable parameters: &filter[id], &filter[user], &filter[expired_date], &filter[created_date], &filter[updated_date].
0
Attacker Value
Unknown
CVE-2021-36874
Disclosure Date: July 27, 2021 (last updated February 23, 2025)
Authenticated Insecure Direct Object References (IDOR) vulnerability in WordPress uListing plugin (versions <= 2.0.5).
0
Attacker Value
Unknown
CVE-2021-36880
Disclosure Date: July 26, 2021 (last updated February 23, 2025)
Unauthenticated SQL Injection (SQLi) vulnerability in WordPress uListing plugin (versions <= 2.0.3), vulnerable parameter: custom.
0
