Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 2

CVE-2023-7239

wp-dashboard-notes < 1.0.11 - Contributor+ Arbitrary Private Notes Update via IDOR

The WP Dashboard Notes WordPress plugin before 1.0.11 does not validate that the user has access to the post_id parameter in its wpdn_update_note AJAX action. This allows users with a role of contributor and above to update notes created by other users.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Jeroensormani
Products
Wp Dashboard Notes
CVE-2023-7198

WPDashboardNotes < 1.0.11 - Unauthorised Deletion of Private Notes

The WP Dashboard Notes WordPress plugin before 1.0.11 is vulnerable to Insecure Direct Object References (IDOR) in post_id= parameter. Authenticated users are able to delete private notes associated with different user accounts. This poses a significant security risk as it violates the principle of least privilege and compromises the integrity and privacy of user data.

CVSS 3.1 · 4.3 Medium EPSS < 1% KEV · Not listed
Vendors
Jeroensormani Wp-dashboard-notes
Products
Wp Dashboard Notes Wp Dashboard Notes