Reputeinfosystems vulnerabilities, page 3
74 vulnerabilities
Known vulnerabilities in Reputeinfosystems products, newest first, with CVSS severity, EPSS, KEV listings and ransomware use, across 14 products.
HighCVE-2024-49699reputeinfosystems · arprice +1 moreWordPress ARPrice plugin <= 4.1.3 - PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.EPSS0.79%HighCVE-2024-49666reputeinfosystems · arprice +1 moreWordPress ARPrice plugin <= 4.1.3 - SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARPrice arprice allows SQL Injection.This issue affects ARPrice: from n/a through <= 4.1.3.EPSS0.37%CriticalCVE-2024-49688reputeinfosystems · arprice +1 moreWordPress ARPrice plugin <= 4.1.3 - Unauthenticated PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in reputeinfosystems ARPrice arprice allows Object Injection.This issue affects ARPrice: from n/a through <= 4.1.3.EPSS0.46%HighCVE-2024-49700reputeinfosystems · arprice +1 moreWordPress ARPrice plugin <= 4.1.3 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARPrice arprice allows Reflected XSS.This issue affects ARPrice: from n/a through <= 4.1.3.EPSS0.31%HighCVE-2024-32705reputeinfosystems · arforms +1 moreWordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary Plugin Activation/Deactivation VulnerabilityMissing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.EPSS0.38%HighCVE-2024-32702reputeinfosystems · arforms +1 moreWordPress ARForms plugin <= 6.4 - Reflected Cross Site Scripting (XSS) vulnerabilityImproper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.EPSS0.35%HighCVE-2024-32704reputeinfosystems · arforms +1 moreWordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary WordPress Options Removal vulnerabilityMissing Authorization vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.EPSS0.34%HighCVE-2024-32706reputeinfosystems · arforms +1 moreWordPress ARForms plugin <= 6.4 - Subscriber+ SQL Injection vulnerabilityImproper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.EPSS0.56%HighCVE-2024-32703reputeinfosystems · arforms +1 moreWordPress ARForms plugin <= 6.4 - Subscriber+ Arbitrary File Deletion vulnerabilityImproper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in reputeinfosystems ARForms arforms.This issue affects ARForms: from n/a through <= 6.4.EPSS0.58%CriticalCVE-2024-32948repute infosystems · armember +2 moreWordPress ARMember – Membership Plugin plugin <= 4.0.28 - Broken Access Control vulnerabilityMissing Authorization vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.28.EPSS0.57%CriticalCVE-2024-30223repute infosystems · armember +2 moreWordPress ARMember plugin <= 4.0.26 - Unauthenticated PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.EPSS0.65%HighCVE-2024-30222repute infosystems · armember +2 moreWordPress ARMember plugin <= 4.0.26 - PHP Object Injection vulnerabilityDeserialization of Untrusted Data vulnerability in Repute Infosystems ARMember.This issue affects ARMember: from n/a through 4.0.26.EPSS0.61%HighCVE-2024-6660reputeinfosystems · appointment booking calendar plugin and scheduling plugin – bookingpress +2 moreBookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.1.5 - Missing Authorization to Authenticated (Subscriber+) Arbitrary Options Update and Arbitrary File UploadThe BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to unauthorized modification of data that can lead to privilege escalation due to a missing capability check on the bookingpress_import_data_continue_process_func function in all versions up to, and including, 1.1.5. This makes it possible for authenticated attackers, with Subscriber-level access and above, to update arbitrary options on the WordPress site and upload arbitrary files. This can be leveraged to update the default role for registration to administrator and enable user registration for attackers to gain administrative user access to a vulnerable site.EPSS0.62%HighCVE-2024-6467reputeinfosystems · appointment booking calendar plugin and scheduling plugin – bookingpress +2 moreBookingPress Appointment Booking <= 1.1.5 - Authenticated (Subscriber+) Arbitrary File Read to Arbitrary File CreationThe BookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin plugin for WordPress is vulnerable to Arbitrary File Read to Arbitrary File Creation in all versions up to, and including, 1.1.5 via the 'bookingpress_save_lite_wizard_settings_func' function. This makes it possible for authenticated attackers, with Subscriber-level access and above, to create arbitrary files that contain the content of files (either on the local server or from a remote location), allowing the execution of any PHP code in those files or the exposure of sensitive information.EPSS0.86%HighCVE-2024-3022reputeinfosystems · appointment booking calendar plugin and scheduling plugin – bookingpress +2 moreBookingPress – Appointment Booking Calendar Plugin and Online Scheduling Plugin <= 1.0.87 - Authenticated (Admin+) Arbitrary File UploadThe BookingPress plugin for WordPress is vulnerable to arbitrary file uploads due to insufficient filename validation in the 'bookingpress_process_upload' function in all versions up to, and including 1.0.87. This allows an authenticated attacker with administrator-level capabilities or higher to upload arbitrary files on the affected site's server, enabling remote code execution.EPSS1.56%MediumCVE-2024-34799repute infosystems · bookingpress +2 moreWordPress BookingPress plugin <= 1.0.82 - Appointment Duration Manipulation vulnerabilityMissing Authorization vulnerability in Repute Infosystems BookingPress.This issue affects BookingPress: from n/a through 1.0.82.EPSS0.37%HighCVE-2019-16902reputeinfosystems · arforms +1 morereputeinfosystems arformsIn the ARforms plugin 3.7.1 for WordPress, arf_delete_file in arformcontroller.php allows unauthenticated deletion of an arbitrary file by supplying the full pathname.EPSS9.73%HighCVE-2019-14679reputeinfosystems · arprice_lite +1 morereputeinfosystems arprice_litecore/views/arprice_import_export.php in the ARPrice Lite plugin 2.2 for WordPress allows wp-admin/admin.php?page=arplite_import_export CSRF.EPSS0.69%CriticalCVE-2026-42417reputeinfosystems · armember premium +1 moreWordPress ARMember Premium plugin <= 7.8 - SQL Injection vulnerabilityUnauthenticated SQL Injection in ARMember Premium <= 7.8 versions.EPSS0.33%HighCVE-2026-39766reputeinfosystems · arforms +1 moreWordPress ARForms plugin <= 7.1.2 - Cross Site Scripting (XSS) vulnerabilityUnauthenticated Cross Site Scripting (XSS) in ARForms <= 7.1.2 versions.EPSS0.25%