Vulnerabilities > AIT PRO > Bulletproof Security > 49.6
DATE | CVE | VULNERABILITY TITLE | RISK |
---|---|---|---|
2022-05-16 | CVE-2022-1265 | Cross-site Scripting vulnerability in Ait-Pro Bulletproof Security The BulletProof Security WordPress plugin before 6.1 does not sanitize and escape some of its CAPTCHA settings, which could allow high-privileged users to perform Cross-Site Scripting attacks even when unfiltered_html is disallowed | 3.5 |
2022-03-21 | CVE-2022-0590 | Cross-site Scripting vulnerability in Ait-Pro Bulletproof Security The BulletProof Security WordPress plugin before 5.8 does not sanitise and escape some of its settings, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. | 3.5 |
2021-09-17 | CVE-2021-39327 | Incomplete Cleanup vulnerability in Ait-Pro Bulletproof Security The BulletProof Security WordPress plugin is vulnerable to sensitive information disclosure due to a file path disclosure in the publicly accessible ~/db_backup_log.txt file which grants attackers the full path of the site, in addition to the path of database backup files. | 5.3 |
2014-12-01 | CVE-2014-8749 | Unspecified vulnerability in Ait-Pro Bulletproof Security Server-side request forgery (SSRF) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to trigger outbound requests that authenticate to arbitrary databases via the dbhost parameter. | 5.0 |
2014-11-06 | CVE-2014-7959 | SQL Injection vulnerability in Ait-Pro Bulletproof Security SQL injection vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tableprefix parameter. | 6.5 |
2014-11-06 | CVE-2014-7958 | Cross-site Scripting vulnerability in Ait-Pro Bulletproof Security Cross-site scripting (XSS) vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dbhost parameter. | 4.3 |