Non notée
CVE-2021-24839 The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX…
Description
The SupportCandy WordPress plugin before 2.2.5 does not have authorisation and CSRF checks in its wpsc_tickets AJAX action, which could allow unauthenticated users to call it and delete arbitrary tickets via the set_delete_permanently_bulk_ticket setting_action. Other actions may be affected as well.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| SupportCandy – Helpdesk & Support Ticket System 2.2 | premières → < 2.2.5 | 2.2.5 |
Autres CVE de SupportCandy – Helpdesk & Support Ticket System
Les 5 CVE de SupportCandy – Helpdesk & Support Ticket System →
CVE-2021-24880
The SupportCandy WordPress plugin before 2.2.7 does not validate and escape the page attribute of its shortcode, which…
Non notée
CVE-2021-24879
The SupportCandy WordPress plugin before 2.2.7 does not have CSRF check in the wpsc_tickets AJAX action, nor has any…
Non notée
CVE-2021-24843
The SupportCandy WordPress plugin before 2.2.7 does not have CRSF check in its wpsc_tickets AJAX action, which could…
Non notée
CVE-2021-24878
The SupportCandy WordPress plugin before 2.2.7 does not sanitise and escape the query string before outputting it back…
Non notée