Show filters
5 Total Results
Displaying 1-5 of 5
Sort by:
Attacker Value
Unknown
CVE-2023-6565
Disclosure Date: February 29, 2024 (last updated February 29, 2024)
The InfiniteWP Client plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 1.12.3 via the multi-call backup option. This makes it possible for unauthenticated attackers to extract sensitive data from a temporary SQL file via repeated GET requests during the limited time window of the backup process.
0
Attacker Value
Unknown
CVE-2020-28642
Disclosure Date: November 16, 2020 (last updated February 22, 2025)
In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attackers to conduct admin Account Takeover attacks.
0
Attacker Value
Unknown
CVE-2014-9520
Disclosure Date: January 05, 2015 (last updated October 05, 2023)
SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter.
0
Attacker Value
Unknown
CVE-2014-9519
Disclosure Date: January 05, 2015 (last updated October 05, 2023)
SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter.
0
Attacker Value
Unknown
CVE-2014-9521
Disclosure Date: January 05, 2015 (last updated October 05, 2023)
Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the uploads directory, as demonstrated by the .php.swp filename.
0
