Read the docs

Salephpscripts

Records4All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9

Exploited now

Salephpscripts records in CISA KEV

No Salephpscripts vulnerabilities are listed in CISA KEV.

Components

Products in the NVD configurations · select one to filter the records
Web Directory Free 4 records CRITICAL

Records

4 records

TI-2024-03312 CVE-2024-3552 · GHSA-jwg5-qqgr-9462

Web Directory Free < 1.7.0 - Unauthenticated SQL Injection

Priority CRITICAL 85

The Web Directory Free WordPress plugin before 1.7.0 does not sanitise and escape a parameter before using it in a SQL statement via an AJAX action available to unauthenticated users, leading to a SQL injection with diff…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.6706 Published 2024-06-13 Fixed in 1.7.0 CWE-89
TI-2024-03427 CVE-2024-3673 · GHSA-8pqc-xcjc-j8v3

Web Directory Free < 1.7.3 - Unauthenticated LFI

Priority HIGH 78

The Web Directory Free WordPress plugin before 1.7.3 does not validate a parameter before using it in an include(), which could lead to Local File Inclusion issues.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.05578 Published 2024-08-30 Fixed in 1.7.3
TI-2024-03423 CVE-2024-3669 · GHSA-7jw8-q7xc-w2cq

Web Directory Free < 1.7.2 - Reflected XSS

Priority MEDIUM 63

The Web Directory Free WordPress plugin before 1.7.2 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege…

CVSS 3.1MEDIUM 6.8 Network Low privileges User interaction EPSS 0.00501 Published 2024-07-30 Fixed in 1.7.2 CWE-79
TI-2023-02064 CVE-2023-2201 · GHSA-7jgf-cw25-29f2

Web Directory Free <= 1.6.8 - Authenticated (Contributor+) SQL Injection via post_id

Priority MEDIUM 42

The Web Directory Free for WordPress is vulnerable to SQL Injection via the ‘post_id’ parameter in versions up to, and including, 1.6.8 due to insufficient escaping on the user supplied parameter and lack of sufficient p…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00815 Published 2023-06-02 No fix listed CWE-89
Open these records in search →