Tipsandtricks-hq vulnerabilities
We track 6 vulnerabilities in Tipsandtricks-hq products across 3 products. 6 are rated high or critical, and none are known to be exploited. The most recent was published on July 15, 2024.
Latest Tipsandtricks-hq vulnerabilities
- 8.8 High severity
wp-cart-for-digital-products: Cross-Site Request Forgery
The wp-cart-for-digital-products WordPress plugin before 8.5.5 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- 7.1 High severity
wp-eMember: Improper Neutralization of Input During Web Page Generation
The wp-eMember WordPress plugin before 10.6.7 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin
- 8.8 High severity
wp-eMember: Unrestricted Upload of File with Dangerous Type
The wp-eMember WordPress plugin before 10.6.6 does not validate files to be uploaded, which could allow admins to upload arbitrary files such as PHP on the server
- 8.8 High severity
wp-eMember: Cross-Site Request Forgery
The wp-eMember WordPress plugin before 10.6.6 does not have CSRF checks in some places, which could allow attackers to make logged in users perform unwanted actions via CSRF attacks
- 8.3 High severity
wp-eMember: Improper Neutralization of Input During Web Page Generation
The wp-eMember WordPress plugin before 10.3.9 does not sanitize and escape the "fieldId" parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting.
- 9.8 Critical severity
Simple Photo Gallery: Improper Neutralization of Special Elements used in an SQL Command
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Tips and Tricks HQ, Peter Petreski Simple Photo Gallery simple-photo-gallery allows SQL Injection.This issue affects Simple Photo Gallery: from n/a through v1