Search criteria
4 vulnerabilities found for Name Directory by Unknown
CVE-2022-2072 (GCVE-0-2022-2072)
Vulnerability from cvelistv5 – Published: 2022-07-25 12:46 – Updated: 2024-08-03 00:24
VLAI?
Title
Name Directory < 1.25.3 - Reflected Cross-Site Scripting
Summary
The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well
Severity ?
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Name Directory |
Affected:
1.25.3 , < 1.25.3
(custom)
|
Credits
Donato Di Pasquale
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:24:44.324Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/3014540c-21b3-481c-83a1-ce3017151af4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Name Directory",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.25.3",
"status": "affected",
"version": "1.25.3",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Donato Di Pasquale"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-25T12:46:43",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/3014540c-21b3-481c-83a1-ce3017151af4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Name Directory \u003c 1.25.3 - Reflected Cross-Site Scripting",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-2072",
"STATE": "PUBLIC",
"TITLE": "Name Directory \u003c 1.25.3 - Reflected Cross-Site Scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Name Directory",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.25.3",
"version_value": "1.25.3"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Donato Di Pasquale"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/3014540c-21b3-481c-83a1-ce3017151af4",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/3014540c-21b3-481c-83a1-ce3017151af4"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-2072",
"datePublished": "2022-07-25T12:46:43",
"dateReserved": "2022-06-13T00:00:00",
"dateUpdated": "2024-08-03T00:24:44.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-2071 (GCVE-0-2022-2071)
Vulnerability from cvelistv5 – Published: 2022-07-25 12:46 – Updated: 2024-08-03 00:24
VLAI?
Title
Name Directory < 1.25.4 - Stored Cross-Site Scripting via CSRF
Summary
The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them.
Severity ?
No CVSS data available.
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Name Directory |
Affected:
1.25.4 , < 1.25.4
(custom)
|
Credits
Donato Di Pasquale
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:24:44.139Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/d3653976-9e0a-4f2b-87f7-26b5e7a74b9d"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Name Directory",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.25.4",
"status": "affected",
"version": "1.25.4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Donato Di Pasquale"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-25T12:46:28",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/d3653976-9e0a-4f2b-87f7-26b5e7a74b9d"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Name Directory \u003c 1.25.4 - Stored Cross-Site Scripting via CSRF",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-2071",
"STATE": "PUBLIC",
"TITLE": "Name Directory \u003c 1.25.4 - Stored Cross-Site Scripting via CSRF"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Name Directory",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.25.4",
"version_value": "1.25.4"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Donato Di Pasquale"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/d3653976-9e0a-4f2b-87f7-26b5e7a74b9d",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/d3653976-9e0a-4f2b-87f7-26b5e7a74b9d"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-2071",
"datePublished": "2022-07-25T12:46:28",
"dateReserved": "2022-06-13T00:00:00",
"dateUpdated": "2024-08-03T00:24:44.139Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-2072 (GCVE-0-2022-2072)
Vulnerability from nvd – Published: 2022-07-25 12:46 – Updated: 2024-08-03 00:24
VLAI?
Title
Name Directory < 1.25.3 - Reflected Cross-Site Scripting
Summary
The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well
Severity ?
No CVSS data available.
CWE
- CWE-79 - Cross-site Scripting (XSS)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Name Directory |
Affected:
1.25.3 , < 1.25.3
(custom)
|
Credits
Donato Di Pasquale
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:24:44.324Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/3014540c-21b3-481c-83a1-ce3017151af4"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Name Directory",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.25.3",
"status": "affected",
"version": "1.25.3",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Donato Di Pasquale"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-79",
"description": "CWE-79 Cross-site Scripting (XSS)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-25T12:46:43",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/3014540c-21b3-481c-83a1-ce3017151af4"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Name Directory \u003c 1.25.3 - Reflected Cross-Site Scripting",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-2072",
"STATE": "PUBLIC",
"TITLE": "Name Directory \u003c 1.25.3 - Reflected Cross-Site Scripting"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Name Directory",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.25.3",
"version_value": "1.25.3"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Donato Di Pasquale"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Name Directory WordPress plugin before 1.25.3 does not sanitise and escape a parameter before outputting it back in the page, leading to a Reflected Cross-Site Scripting. Furthermore, as the payload is also saved into the database after the request, it leads to a Stored XSS as well"
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-79 Cross-site Scripting (XSS)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/3014540c-21b3-481c-83a1-ce3017151af4",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/3014540c-21b3-481c-83a1-ce3017151af4"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-2072",
"datePublished": "2022-07-25T12:46:43",
"dateReserved": "2022-06-13T00:00:00",
"dateUpdated": "2024-08-03T00:24:44.324Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}
CVE-2022-2071 (GCVE-0-2022-2071)
Vulnerability from nvd – Published: 2022-07-25 12:46 – Updated: 2024-08-03 00:24
VLAI?
Title
Name Directory < 1.25.4 - Stored Cross-Site Scripting via CSRF
Summary
The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them.
Severity ?
No CVSS data available.
CWE
- CWE-352 - Cross-Site Request Forgery (CSRF)
Assigner
References
| URL | Tags | ||||
|---|---|---|---|---|---|
|
|||||
Impacted products
| Vendor | Product | Version | ||
|---|---|---|---|---|
| Unknown | Name Directory |
Affected:
1.25.4 , < 1.25.4
(custom)
|
Credits
Donato Di Pasquale
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-03T00:24:44.139Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "https://wpscan.com/vulnerability/d3653976-9e0a-4f2b-87f7-26b5e7a74b9d"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "Name Directory",
"vendor": "Unknown",
"versions": [
{
"lessThan": "1.25.4",
"status": "affected",
"version": "1.25.4",
"versionType": "custom"
}
]
}
],
"credits": [
{
"lang": "en",
"value": "Donato Di Pasquale"
}
],
"descriptions": [
{
"lang": "en",
"value": "The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them."
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-352",
"description": "CWE-352 Cross-Site Request Forgery (CSRF)",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2022-07-25T12:46:28",
"orgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"shortName": "WPScan"
},
"references": [
{
"tags": [
"x_refsource_MISC"
],
"url": "https://wpscan.com/vulnerability/d3653976-9e0a-4f2b-87f7-26b5e7a74b9d"
}
],
"source": {
"discovery": "EXTERNAL"
},
"title": "Name Directory \u003c 1.25.4 - Stored Cross-Site Scripting via CSRF",
"x_generator": "WPScan CVE Generator",
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "contact@wpscan.com",
"ID": "CVE-2022-2071",
"STATE": "PUBLIC",
"TITLE": "Name Directory \u003c 1.25.4 - Stored Cross-Site Scripting via CSRF"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Name Directory",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "1.25.4",
"version_value": "1.25.4"
}
]
}
}
]
},
"vendor_name": "Unknown"
}
]
}
},
"credit": [
{
"lang": "eng",
"value": "Donato Di Pasquale"
}
],
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The Name Directory WordPress plugin before 1.25.4 does not have CSRF check when importing names, and is also lacking sanitisation as well as escaping in some of the imported data, which could allow attackers to make a logged in admin import arbitrary names with XSS payloads in them."
}
]
},
"generator": "WPScan CVE Generator",
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "CWE-352 Cross-Site Request Forgery (CSRF)"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://wpscan.com/vulnerability/d3653976-9e0a-4f2b-87f7-26b5e7a74b9d",
"refsource": "MISC",
"url": "https://wpscan.com/vulnerability/d3653976-9e0a-4f2b-87f7-26b5e7a74b9d"
}
]
},
"source": {
"discovery": "EXTERNAL"
}
}
}
},
"cveMetadata": {
"assignerOrgId": "1bfdd5d7-9bf6-4a53-96ea-42e2716d7a81",
"assignerShortName": "WPScan",
"cveId": "CVE-2022-2071",
"datePublished": "2022-07-25T12:46:28",
"dateReserved": "2022-06-13T00:00:00",
"dateUpdated": "2024-08-03T00:24:44.139Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1"
}