https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Wed, 07 Oct 2026 20:42:20 +0000 https://cve.radiocsirt.org/vuln/cnvd-2022-68557 cnvd-2022-68557 https://cve.radiocsirt.org/vuln/cnvd-2022-68557 https://cve.radiocsirt.org/vuln/euvd-2026-24174 EUVD-2026-24174 https://cve.radiocsirt.org/vuln/euvd-2026-24174 https://cve.radiocsirt.org/vuln/fkie_cve-2021-24790 <p>The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.</p> <p>The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2021-24790 https://cve.radiocsirt.org/vuln/ghsa-3p9w-pv5h-crrp <p>The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.</p> <p>The Contact Form Advanced Database WordPress plugin through 1.0.8 does not have any authorisation as well as CSRF checks in its delete_cf7_data and export_cf7_data AJAX actions, available to any authenticated users, which could allow users with a role as low as subscriber to call them. The delete_cf7_data would lead to arbitrary metadata deletion, as well as PHP Object Injection if a suitable gadget chain is present in another plugin, as user data is passed to the maybe_unserialize() function without being first validated.</p> https://cve.radiocsirt.org/vuln/ghsa-3p9w-pv5h-crrp https://cve.radiocsirt.org/vuln/gsd-2021-24790 gsd-2021-24790 https://cve.radiocsirt.org/vuln/gsd-2021-24790