Vulnerabilities

TI-2024-17011 CVE-2024-25911 · GHSA-wq22-jrvv-wxmv

WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary File Deletion vulnerability

MEDIUM 44

Missing Authorization vulnerability in Skymoon Labs MoveTo.This issue affects MoveTo: from n/a through 6.2.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00529 Published 2024-04-16 No fix listed CWE-862

TI-2024-17012 CVE-2024-25912 · GHSA-r8gf-vrx9-6qwc

WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary WordPress Settings Change vulnerability

MEDIUM 50

Missing Authorization vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00582 Published 2024-03-21 No fix listed CWE-862

TI-2024-17010 CVE-2024-25910 · GHSA-6rg4-5cvm-2w3m

WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL Injection

HIGH 82

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00565 Published 2024-02-28 No fix listed CWE-89

TI-2024-17013 CVE-2024-25913 · GHSA-p85g-mx27-m79q

WordPress MoveTo Plugin <= 6.2 is vulnerable to Arbitrary File Upload

MEDIUM 50

Unrestricted Upload of File with Dangerous Type vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.0063 Published 2024-02-26 No fix listed CWE-434

TI-2019-04483 CVE-2019-6296 · GHSA-jcjj-fmx9-4763

Cleanto 5.0 has SQL Injection via the assets/lib/export_ajax.php id parameter.

MEDIUM 45

Cleanto 5.0 has SQL Injection via the assets/lib/export_ajax.php id parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01331 Published 2019-01-15 No fix listed CWE-89

TI-2019-04482 CVE-2019-6295 · GHSA-r7vc-mvc7-vwj9

Cleanto 5.0 has SQL Injection via the assets/lib/service_method_ajax.php service_id parameter.

MEDIUM 45

Cleanto 5.0 has SQL Injection via the assets/lib/service_method_ajax.php service_id parameter.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.01342 Published 2019-01-15 No fix listed CWE-89

Vulnerabilities

Filters

WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary File Deletion vulnerability

WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary WordPress Settings Change vulnerability

WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL Injection

WordPress MoveTo Plugin <= 6.2 is vulnerable to Arbitrary File Upload

Cleanto 5.0 has SQL Injection via the assets/lib/export_ajax.php id parameter.

Cleanto 5.0 has SQL Injection via the assets/lib/service_method_ajax.php service_id parameter.