Vulnerabilities > WEB Dorado

DATE CVE VULNERABILITY TITLE RISK
2021-11-08 CVE-2021-24625 SQL Injection vulnerability in Web-Dorado Spidercatalog
The SpiderCatalog WordPress plugin through 1.7.3 does not sanitise or escape the 'parent' and 'ordering' parameters from the admin dashboard before using them in a SQL statement, leading to a SQL injection when adding a category
network
low complexity
web-dorado CWE-89
6.5
2021-07-12 CVE-2021-24426 Cross-site Scripting vulnerability in Web-Dorado Backup-Wd
The Backup by 10Web – Backup and Restore Plugin WordPress plugin through 1.0.20 does not sanitise or escape the tab parameter before outputting it back in the page, leading to a reflected Cross-Site Scripting issue
network
web-dorado CWE-79
3.5
2019-04-29 CVE-2019-11591 Inclusion of Functionality from Untrusted Control Sphere vulnerability in Web-Dorado Contact Form
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
6.8
2019-04-26 CVE-2019-11557 Path Traversal vulnerability in Web-Dorado WP Form Builder
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $_POST['action'] value and the $_GET['action'] value, and the latter is unsanitized.
network
web-dorado CWE-22
6.8
2019-01-09 CVE-2018-16164 Cross-site Scripting vulnerability in Web-Dorado Event Calendar WD
Cross-site scripting vulnerability in Event Calendar WD version 1.1.21 and earlier allows remote authenticated attackers to inject arbitrary web script or HTML via unspecified vectors.
network
web-dorado CWE-79
3.5
2018-04-27 CVE-2018-10504 Improper Neutralization of Formula Elements in a CSV File vulnerability in Web-Dorado Form Maker
The WebDorado "Form Maker by WD" plugin before 1.12.24 for WordPress allows CSV injection.
6.8
2018-04-23 CVE-2018-10301 Cross-site Scripting vulnerability in Web-Dorado WD Instagram Feed
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 Premium for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in a comment on an Instagram post.
network
web-dorado CWE-79
4.3
2018-04-23 CVE-2018-10300 Cross-site Scripting vulnerability in Web-Dorado WD Instagram Feed
Cross-site scripting (XSS) vulnerability in the Web-Dorado Instagram Feed WD plugin before 1.3.1 for WordPress allows remote attackers to inject arbitrary web script or HTML by passing payloads in an Instagram profile's bio.
network
web-dorado CWE-79
4.3
2018-02-17 CVE-2018-5991 SQL Injection vulnerability in Web-Dorado Form Maker 3.6.12
SQL Injection exists in the Form Maker 3.6.12 component for Joomla! via the id, from, or to parameter in a view=stats request, a different vulnerability than CVE-2015-2798.
network
low complexity
web-dorado CWE-89
7.5
2018-02-17 CVE-2018-5981 SQL Injection vulnerability in Web-Dorado Gallery WD 1.3.6
SQL Injection exists in the Gallery WD 1.3.6 component for Joomla! via the tag_id parameter or gallery_id parameter.
network
low complexity
web-dorado CWE-89
7.5