Vulnerabilities

TI-2014-07300 CVE-2014-8949 · GHSA-cc67-g2vp-78hq

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated…

LOW 37

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4w_trace parameter.

CVSS 2.0MEDIUM 6.0 Network Low privileges Interaction — EPSS 0.07513 Published 2014-11-16 No fix listed CWE-94

TI-2014-07299 CVE-2014-8948 · GHSA-j7f7-ccjp-pgj4

Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through…

LOW 36

Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified…

CVSS 2.0MEDIUM 6.8 Network No auth Interaction — EPSS 0.03721 Published 2014-11-16 No fix listed CWE-352

TI-2014-03126 CVE-2014-3849 · GHSA-9rfq-ff3x-cwxp

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict…

LOW 29

The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the A…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.05973 Published 2014-05-23 No fix listed CWE-264

TI-2014-03125 CVE-2014-3848 · GHSA-qgmq-8wm8-jj4m

The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access…

LOW 35

The iMember360 plugin before 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to obtain database credentials via the i4w_dbinfo parameter.

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.09149 Published 2014-05-23 No fix listed CWE-264

TI-2014-03120 CVE-2014-3842 · GHSA-2wjm-jw3m-vjrm

Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012…

LOW 27

Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt paramete…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.04509 Published 2014-05-22 No fix listed CWE-79