Show filters
16 Total Results
Displaying 1-10 of 16
Sort by:
Attacker Value
Unknown
CVE-2025-24643
Disclosure Date: February 03, 2025 (last updated February 04, 2025)
Missing Authorization vulnerability in Amento Tech Pvt ltd WPGuppy allows Exploiting Incorrectly Configured Access Control Security Levels. This issue affects WPGuppy: from n/a through 1.1.0.
0
Attacker Value
Unknown
CVE-2024-56280
Disclosure Date: January 07, 2025 (last updated January 07, 2025)
Incorrect Privilege Assignment vulnerability in Amento Tech Pvt ltd WPGuppy allows Privilege Escalation.This issue affects WPGuppy: from n/a through 1.1.0.
0
Attacker Value
Unknown
CVE-2024-49222
Disclosure Date: January 07, 2025 (last updated January 07, 2025)
Deserialization of Untrusted Data vulnerability in Amento Tech Pvt ltd WPGuppy allows Object Injection.This issue affects WPGuppy: from n/a through 1.1.0.
0
Attacker Value
Unknown
CVE-2023-31903
Disclosure Date: May 17, 2023 (last updated October 08, 2023)
GuppY CMS 6.00.10 is vulnerable to Unrestricted File Upload which allows remote attackers to execute arbitrary code by uploading a php file.
0
Attacker Value
Unknown
CVE-2021-24997
Disclosure Date: December 27, 2021 (last updated February 23, 2025)
The WP Guppy WordPress plugin before 1.3 does not have any authorisation in some of the REST API endpoints, allowing any user to call them and could lead to sensitive information disclosure, such as usernames and chats between users, as well as be able to send messages as an arbitrary user
0
Attacker Value
Unknown
CVE-2013-5983
Disclosure Date: February 06, 2014 (last updated October 05, 2023)
Multiple cross-site scripting (XSS) vulnerabilities in GuppY before 4.6.28 allow remote attackers to inject arbitrary web script or HTML via the (1) "an" parameter to agenda.php or (2) cat parameter to mobile/thread.php.
0
Attacker Value
Unknown
CVE-2010-1740
Disclosure Date: May 06, 2010 (last updated October 04, 2023)
SQL injection vulnerability in newsletter.php in GuppY 4.5.18 allows remote attackers to execute arbitrary SQL commands via the lng parameter.
0
Attacker Value
Unknown
CVE-2007-5844
Disclosure Date: November 06, 2007 (last updated October 04, 2023)
Directory traversal vulnerability in inc/includes.inc in GuppY 4.6.3 allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the selskin parameter to index.php. NOTE: this can be leveraged for remote file inclusion by including inc/boxleft.inc and specifying a URL in the xposbox[L][] array parameter.
0
Attacker Value
Unknown
CVE-2007-5845
Disclosure Date: November 06, 2007 (last updated October 04, 2023)
Directory traversal vulnerability in error.php in GuppY 4.6.3, 4.5.16, and earlier allows remote attackers to include and execute arbitrary local files via a .. (dot dot) in the id parameter. NOTE: this can be leveraged to bypass authentication and upload arbitrary files by including admin/inc/upload.inc and specifying certain multipart/form-data input for admin/inc/upload.inc.
0
Attacker Value
Unknown
CVE-2007-1451
Disclosure Date: March 14, 2007 (last updated October 04, 2023)
GuppY 4.0 allows remote attackers to delete arbitrary files via a direct request to install/install.php, then selecting "Installation propre" (cleanup.php) and then "Suppression des fichiers d'installation" (delete.php).
0
