Contact Us

Hubo un error al intentar enviar su formulario. Por favor, inténtelo de nuevo.

WordPress Form Vibes \u2013 Database Manager for Forms Plugin <= 1.4.10 is vulnerable to SQL Injection

Software: Form Vibes \u2013 Database Manager for Forms

Link: https:\/\/wordpress.org\/plugins\/form-vibes\/#developers

Affected Version <= 1.4.10

Fixed in version 1.4.11 ","date":"2024-07-12"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:H\/I:H\/A:H","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"h","i":"h","a":"h","score":"8.8","severity":"h","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-89","name":"Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')","description":"The product constructs all or part of an SQL command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended SQL command when it is sent to a downstream component. Without sufficient removal or quoting of SQL syntax in user-controllable inputs, the generated SQL query can cause those inputs to be interpreted as SQL instead of ordinary user data."}]}},{"uuid":"2122a618a7ea8edc508736c4b151d028890d1614d5139d8417fce3d827930818","name":"Form Vibes – Database Manager for Forms [form-vibes] < 1.4.13","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.4.13","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2024-5309","name":"CVE-2024-5309","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2024-5309","description":"[en] The Form Vibes \u2013 Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fv_export_csv, reset_settings, save_settings, save_columns_settings, get_analytics_data, get_event_logs_data, delete_submissions, and get_submissions functions in all versions up to, and including, 1.4.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple unauthorized actions. NOTE: This vulnerability is partially fixed in version 1.4.12.","date":"2024-09-05"},{"id":"1e53c3e0edb4b13020f901118c426c542210fced","name":"Form Vibes \u2013 Database Manager for Forms <= 1.4.12 - Missing Authorization in Multiple Functions","link":"https:\/\/www.wordfence.com\/threat-intel\/vulnerabilities\/wordpress-plugins\/form-vibes\/form-vibes-database-manager-for-forms-1412-missing-authorization-in-multiple-functions","description":"The Form Vibes \u2013 Database Manager for Forms plugin for WordPress is vulnerable to unauthorized access of data and modification of data due to a missing capability check on the fv_export_csv, reset_settings, save_settings, save_columns_settings, get_analytics_data, get_event_logs_data, delete_submissions, and get_submissions functions in all versions up to, and including, 1.4.12. This makes it possible for authenticated attackers, with Subscriber-level access and above, to perform multiple unauthorized actions. NOTE: This vulnerability is partially fixed in version 1.4.12.","date":"2024-09-04"},{"id":"d43a8b959aed6a84bff66543c849579bb77ed5a4","name":"WordPress Form Vibes \u2013 Database Manager for Forms Plugin <= 1.4.12 is vulnerable to Broken Access Control","link":"https:\/\/patchstack.com\/database\/wordpress\/plugin\/form-vibes\/vulnerability\/wordpress-form-vibes-database-manager-for-forms-plugin-1-4-12-missing-authorization-in-multiple-functions-vulnerability","description":"

WordPress Form Vibes \u2013 Database Manager for Forms Plugin <= 1.4.12 is vulnerable to Broken Access Control

Affected Version <= 1.4.12","date":"2024-09-05"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:N","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"l","a":"n","score":"5.4","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}]}},{"uuid":"ad5a15c048bde538e67de3e7c68069acb084a99327c2ca9f18e6a40dcfecf945","name":"Form Vibes – Database Manager for Forms [form-vibes] < 1.4.3","description":null,"operator":{"min_version":null,"min_operator":null,"max_version":"1.4.3","max_operator":"lt","unfixed":"0","closed":"0"},"source":[{"id":"CVE-2022-4974","name":"CVE-2022-4974","link":"https:\/\/www.cve.org\/CVERecord?id=CVE-2022-4974","description":"[en] The Freemius SDK, as used by hundreds of WordPress plugin and theme developers, was vulnerable to Cross-Site Request Forgery and Information disclosure due to missing capability checks and nonce protection on the _get_debug_log, _get_db_option, and the _set_db_option functions in versions up to, and including 2.4.2. Any WordPress plugin or theme running a version of Freemius less than 2.4.3 is vulnerable.","date":"2024-10-16"}],"impact":{"cvss":{"version":"3.1","vector":"CVSS:3.1\/AV:N\/AC:L\/PR:L\/UI:N\/S:U\/C:L\/I:L\/A:L","av":"n","ac":"l","pr":"l","ui":"n","s":"u","c":"l","i":"l","a":"l","score":"6.3","severity":"m","exploitable":"0.0","impact":"0.0"},"cwe":[{"cwe":"CWE-862","name":"Missing Authorization","description":"The product does not perform an authorization check when an actor attempts to access a resource or perform an action."}]}}]},"updated":"1750132258"}

Hubo un error al intentar enviar su formulario. Por favor, inténtelo de nuevo.