wpDiscuz vulnerabilities
4 known vulnerabilities in wpDiscuz from gVectors. 4 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 7.5 High severity
SNMP Web Pro: Improper Limitation of a Pathname to a Restricted Directory
Voltronic Power SNMP Web Pro version 1.1 contains a pre-authentication path traversal vulnerability in the upload.cgi endpoint that allows unauthenticated attackers to read arbitrary files on the device filesystem by supplying directory traversal sequences in
- 7.5 High severity
wpDiscuz: Improper Neutralization of Special Elements used in an SQL Command
wpDiscuz before 7.6.47 contains an SQL injection vulnerability in the getAllSubscriptions() function where string parameters lack proper quote escaping in SQL queries. Attackers can inject malicious SQL code through email, activation_key, subscription_date, an
- 7.5 High severity
wpDiscuz: Allocation of Resources Without Limits or Throttling
wpDiscuz before 7.6.47 contains an unauthenticated denial of service vulnerability that allows anonymous users to trigger mass notification emails by exploiting the checkNotificationType() function. Attackers can repeatedly call the wpdiscuz-ajax.php endpoint
- 9.8 Critical severity
Comments – wpDiscuz: Authentication Bypass Using an Alternate Path or Channel
The Comments – wpDiscuz plugin for WordPress is vulnerable to authentication bypass in all versions up to, and including, 7.6.24. This is due to insufficient verification on the user being returned by the social login token. This makes it possible for unauthen