CVE-2022-40312
published 2023-12-18CVE-2022-40312: Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and…
PriorityP335medium6.5CVSS 3.1
AVNACLPRLUINSUCHINAN
EPSS
0.43%
34.6th percentile
Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| givewp | givewp | <= 2.25.1 | — |
| givewp | givewp_donation_plugin_and_fundraising_platform | n/a – 2.25.1 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-vx34-745v-7g3g: Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform
ghsa_unreviewed·2023-12-18
CVE-2022-40312 [MEDIUM] CWE-918 GHSA-vx34-745v-7g3g: Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform
Server-Side Request Forgery (SSRF) vulnerability in GiveWP GiveWP – Donation Plugin and Fundraising Platform.This issue affects GiveWP – Donation Plugin and Fundraising Platform: from n/a through 2.25.1.
GHSA
OpenNMS vulnerable to Cross-site Scripting
ghsa·2023-08-14
CVE-2023-40312 [MEDIUM] CWE-79 OpenNMS vulnerable to Cross-site Scripting
OpenNMS vulnerable to Cross-site Scripting
Multiple reflected XSS were found on different JSP files with unsanitized parameters in OpenNMS Horizon 31.0.8 and versions earlier than 32.0.2 on multiple platforms that an attacker can modify to craft a malicious XSS payload. The solution is to upgrade to Meridian 2023.1.6, 2022.1.19, 2021.1.30, 2020.1.38 or Horizon 32.0.2 or newer. Meridian and Horizon installation instructions state that they are intended for installation within an organization's private networks and should not be directly accessible from the Internet. OpenNMS thanks Jordi Miralles Comins for reporting this issue.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-12-18
Published