Vulnerabilities

TI-2024-00615 CVE-2024-0668 · GHSA-fvvm-3cr2-6qx2

Advanced Database Cleaner <= 3.1.3 - Authenticated(Administrator+) PHP Object Injection via process_bulk_action

LOW 36

The Advanced Database Cleaner plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 3.1.3 via deserialization of untrusted input in the 'process_bulk_action' function.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01139 Published 2024-02-05 No fix listed CWE-502

TI-2023-27174 CVE-2023-49764 · GHSA-c9rr-75hh-4hj4

WordPress Advanced Database Cleaner Plugin <= 3.1.2 is vulnerable to SQL Injection

LOW 35

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Younes JFR.

CVSS 3.1HIGH 7.6 Network High privileges No interaction EPSS 0.0074 Published 2023-12-19 No fix listed CWE-89

TI-2022-23159 CVE-2022-46813 · GHSA-2cc9-4c6w-32wj

WordPress Advanced Database Cleaner Plugin <= 3.1.1 is vulnerable to Cross Site Request Forgery (CSRF)

LOW 38

Cross-Site Request Forgery (CSRF) vulnerability in Younes JFR.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00256 Published 2023-05-23 No fix listed CWE-352

TI-2022-02011 CVE-2022-2173 · GHSA-h52v-6ppv-4xw2

Advanced Database Cleaner < 3.1.1 - Reflected Cross-Site Scripting

LOW 29

The Advanced Database Cleaner WordPress plugin before 3.1.1 does not escape numerous generated URLs before outputting them back in href attributes of admin dashboard pages, leading to Reflected Cross-Site Scripting

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00788 Published 2022-07-17 Fixed in 3.1.1 CWE-79

TI-2021-07201 CVE-2021-24921 · GHSA-8x47-hqwx-vmvf

Advanced Database Cleaner < 3.0.4 - Reflected Cross-Site Scripting

LOW 29

The Advanced Database Cleaner WordPress plugin before 3.0.4 does not sanitise and escape $_GET keys and values before outputting them back in attributes, leading to Reflected Cross-Site Scripting issues

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.008 Published 2022-02-21 Fixed in 3.0.4 CWE-79

TI-2021-06433 CVE-2021-24141 · GHSA-6h67-c8r4-fr78

Advanced Database Cleaner < 3.0.2 - Authenticated SQL injection

LOW 34

Unvaludated input in the Advanced Database Cleaner plugin, versions before 3.0.2, lead to SQL injection allowing high privilege users (admin+) to perform SQL attacks.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.01205 Published 2021-03-18 Fixed in 3.0.2 CWE-89