Usabilitydynamics - vulnerabilities (CVEs)
8 CVEs in 2 products, 0 in the last 30 days, newest from 2024-01-16.
Products
- Wp-invoice - 7 CVEs
- Wp-crm - 1 CVEs
Newest CVEs of Usabilitydynamics
- CVE-2022-1617 - CVSS 6.1 (medium), 2024-01-16: The WP-Invoice WordPress plugin through 4.3.1 does not have CSRF check in place when updating its settings, and is lacking sanitisation as well as escaping in…
- CVE-2022-1202 - CVSS 7.8 (high), 2022-06-13: The WP-CRM WordPress plugin through 1.2.1 does not validate and sanitise fields when exporting people to a CSV file, leading to a CSV injection vulnerability.
- CVE-2016-11011 - CVSS 6.5 (medium), 2019-09-20: The wp-invoice plugin before 4.1.1 for WordPress has wpi_update_user_option privilege escalation.
- CVE-2016-11007 - CVSS 5.3 (medium), 2019-09-20: The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_user_id for invoice retrieval.
- CVE-2016-11010 - CVSS 5.3 (medium), 2019-09-20: The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_twocheckout payer metadata updates.
- CVE-2016-11006 - CVSS 5.3 (medium), 2019-09-20: The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control for admin_init settings changes.
- CVE-2016-11009 - CVSS 5.3 (medium), 2019-09-20: The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_interkassa payer metadata updates.
- CVE-2016-11008 - CVSS 5.3 (medium), 2019-09-20: The wp-invoice plugin before 4.1.1 for WordPress has incorrect access control over wpi_paypal payer metadata updates.
