Vulnerabilities

TI-2024-33135 CVE-2024-49649 · GHSA-j6w8-j3gw-86hg

WordPress Build App Online plugin <= 1.0.23 - Local File Inclusion vulnerability

MEDIUM 50

Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') vulnerability in hakeemnala Build App Online build-app-online allows PHP Local File Inclusion.This issue affects Bui…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00602 Published 2025-01-07 No fix listed CWE-98

TI-2024-35949 CVE-2024-53751 · GHSA-mh5g-q2mv-4wjm

WordPress Build App Online plugin <= 1.0.23 - Cross Site Request Forgery (CSRF) vulnerability

LOW 37

Cross-Site Request Forgery (CSRF) vulnerability in hakeemnala Build App Online build-app-online allows Cross Site Request Forgery.This issue affects Build App Online: from n/a through <= 1.0.23.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00179 Published 2024-12-02 No fix listed CWE-352

TI-2023-06644 CVE-2023-7264 · GHSA-mxcr-f478-crp2

Build App Online <= 1.0.22 - Account Takeover via Weak Password Reset Mechanism

MEDIUM 44

The Build App Online plugin for WordPress is vulnerable to account takeover due to a weak password reset mechanism in all versions up to, and including, 1.0.22.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00621 Published 2024-06-11 No fix listed CWE-640

TI-2023-28131 CVE-2023-51479 · GHSA-xpqv-f82r-327v

WordPress Build App Online plugin <= 1.0.19 - Authenticated Privilege Escalation vulnerability

MEDIUM 41

Improper Privilege Management vulnerability in Abdul Hakeem Build App Online allows Privilege Escalation.This issue affects Build App Online: from n/a through 1.0.19.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00476 Published 2024-05-17 No fix listed CWE-269

TI-2023-28130 CVE-2023-51478 · GHSA-6x77-72j8-vq6j

WordPress Build App Online plugin <= 1.0.19 - Unauthenticated Account Takeover vulnerability