Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

2 records

Release: DoLogin Security 3.7 Clear all filters
TI-2023-04195 CVE-2023-4549 · GHSA-897r-hcfg-v9vh

DoLogin Security < 3.7 - Unauthenticated Stored Cross-Site Scripting

Priority LOW 28

The DoLogin Security WordPress plugin before 3.7 does not properly sanitize IP addresses coming from the X-Forwarded-For header, which can be used by attackers to conduct Stored XSS attacks via WordPress' login form.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00698 Published 2023-09-25 Fixed in 3.7 CWE-79
TI-2023-04270 CVE-2023-4631 · GHSA-5hrc-f88x-6wm7

DoLogin Security < 3.7 - IP Spoofing

Priority MEDIUM 63

The DoLogin Security WordPress plugin before 3.7 uses headers such as the X-Forwarded-For to retrieve the IP address of the request, which could lead to IP spoofing.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00715 Published 2023-09-25 Fixed in 3.7