Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
2 selected

7 records

Vendor: AITpro Component: Bulletproof Security Clear all filters
TI-2022-01150 CVE-2022-1265 · GHSA-xx7x-j67h-66rj

BulletProof Security < 6.1 - Admin+ Stored Cross-Site Scripting

Priority LOW 23

The BulletProof Security WordPress plugin before 6.1 does not sanitize and escape some of its CAPTCHA settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-05-16 Fixed in 6.1 CWE-79
TI-2022-00507 CVE-2022-0590 · GHSA-92j5-277h-r47f

BulletProof Security < 5.8 - Admin+ Stored Cross-Site Scripting (XSS)

Priority LOW 23

The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capabil…

CVSS 3.1MEDIUM 4.8 Network High privileges User interaction EPSS 0.00598 Published 2022-03-21 Fixed in 5.8 CWE-79
TI-2021-16696 CVE-2021-39327 · GHSA-6qg5-vf7x-4fm3

BulletProof Security <= 5.1 Sensitive Information Disclosure

Priority HIGH 68

The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the si…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.71688 Published 2021-09-17 No fix listed CWE-200
TI-2014-06621 CVE-2014-7959 · GHSA-vr23-5gw8-f36f

SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security…

Priority LOW 33

SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tableprefix parameter.

CVSS 2.0MEDIUM 6.5 Network Low privileges Interaction — EPSS 0.021 Published 2014-11-06 No fix listed CWE-89
TI-2014-06620 CVE-2014-7958 · GHSA-cx3j-j3m2-q9vw

Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the…

Priority LOW 25

Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dbhost paramet…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02508 Published 2014-11-06 No fix listed CWE-79