Non notée
CVE-2023-2761 The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter…
Description
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a SQL statement in some admin pages, leading to a SQL injection exploitable by high privilege users such as admin.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| User Activity Log 1.6 | premières → < 1.6.3 | 1.6.3 |
Autres CVE de User Activity Log
Les 5 CVE de User Activity Log →
CVE-2025-13471
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases,…
5.3
Moyenne
CVE-2023-4279
This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers,…
7.5
Élevée
CVE-2023-4269
The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs,…
4.3
Moyenne
CVE-2023-3435
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before…
Non notée