Cyberlord92 Active Directory Integration Ldap Integration vulnerabilities
4 known vulnerabilities affecting cyberlord92/active_directory_integration_ldap_integration.
Total CVEs
4
CISA KEV
0
Public exploits
0
Exploited in wild
0
Severity breakdown
HIGH1MEDIUM3
Vulnerabilities
Page 1 of 1
CVE-2023-3447P3HIGHCVSS 7.5≤ 4.1.52023-06-29
CVE-2023-3447 [HIGH] CWE-90 CVE-2023-3447: The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injec
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Injection in versions up to, and including, 4.1.5. This is due to insufficient escaping on the supplied username value. This makes it possible for attackers, with an existing account on a vulnerable WordPress instance, to extract potentially sensitive informati
nvd
CVE-2023-4506P3MEDIUMCVSS 6.5≤ 4.1.102023-09-27
CVE-2023-4506 [MEDIUM] CWE-306 CVE-2023-4506: The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passb
The Active Directory Integration / LDAP Integration plugin for WordPress is vulnerable to LDAP Passback in versions up to, and including, 4.1.10. This is due to insufficient validation when changing the LDAP server. This makes it possible for authenticated attackers, with administrative access and above, to change the LDAP server and retrieve the cred
nvd
CVE-2023-2599P4MEDIUMCVSS 6.5≤ 4.1.42023-06-09
CVE-2023-2599 [MEDIUM] CWE-352 CVE-2023-2599: The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery le
The Active Directory Integration plugin for WordPress is vulnerable to Cross-Site Request Forgery leading to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to missing nonce verification on the get_users function and insufficient escaping on the user supplied parameter and lack of sufficient pr
nvd
CVE-2023-2484P4MEDIUMCVSS 4.9≤ 4.1.42023-06-09
CVE-2023-2484 [MEDIUM] CWE-89 CVE-2023-2484: The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via
The Active Directory Integration plugin for WordPress is vulnerable to time-based SQL Injection via the orderby and order parameters in versions up to, and including, 4.1.4 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated attackers with admi
nvd