Non notée
CVE-2023-3435 The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before…
Description
The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL statement as part of its exportation feature, allowing unauthenticated attackers to conduct SQL injection attacks.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| User Activity Log 1.6 | premières → < 1.6.5 | 1.6.5 |
Autres CVE de User Activity Log
Les 5 CVE de User Activity Log →
CVE-2025-13471
The User Activity Log WordPress plugin through 2.2 does not properly handle failed login attempts in some cases,…
5.3
Moyenne
CVE-2023-4279
This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers,…
7.5
Élevée
CVE-2023-4269
The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs,…
4.3
Moyenne
CVE-2023-2761
The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter…
Non notée