Overview 109 matches · 0 in Waratek scope · 0 protected · 4 exploited · 0 CISA KEV · 12 public PoC · 1 EPSS ≥ 0.5
109matches
0in Waratek scope0.0%
0protected0.0%
4exploited3.7%
0CISA KEV0.0%
12public PoC11.0%
1EPSS ≥ 0.50.9%
Protected by Waratek
0
0.0%
Rule in development
0
0.0%
Mitigation candidate
0
0.0%
No exploit published
0
0.0%
Outside Waratek scope
0
0.0%
Not applicable
109
100.0%
Withdrawn CVE
0
0.0%
blocked by ARMR today
0
0.0%
partly blocked
0
0.0%
not blocked
109
100.0%
not established
0
0.0%
unrecorded
0
0.0%
split by
peak 26 / year
20051
Not applicable1
Low1
not blocked1
No public exploit1
20060
20070
20080
20092
Not applicable2
High1
Medium1
not blocked2
Working exploit published2
20100
20111
Not applicable1
High1
not blocked1
Working exploit published1
20120
20131
Not applicable1
High1
not blocked1
No public exploit1
20145
Not applicable5
Medium5
not blocked5
No public exploit5
20152
Not applicable2
High1
Medium1
not blocked2
No public exploit2
20161
Not applicable1
Critical1
not blocked1
Working exploit published1
20170
20185
Not applicable5
High1
Medium4
not blocked5
Working exploit published1
No public exploit4
20199
Not applicable9
Critical3
High2
Medium4
not blocked9
Working exploit published1
Proof of concept only1
No public exploit7
20202
Not applicable2
Medium2
not blocked2
No public exploit2
202116
Not applicable16
High7
Medium9
not blocked16
Exploited3
Working exploit published1
No public exploit12
20228
Not applicable8
Critical1
High3
Medium4
not blocked8
Working exploit published1
Proof of concept only1
No public exploit6
202313
Not applicable13
Critical2
High2
Medium9
not blocked13
Working exploit published2
Proof of concept only3
No public exploit8
202426
Not applicable26
Critical3
High7
Medium16
not blocked26
Working exploit published1
Proof of concept only1
No public exploit24
202513
Not applicable13
Critical1
High2
Medium10
not blocked13
Exploited1
Proof of concept only6
No public exploit6
20264
Not applicable4
High1
Medium3
not blocked4
Proof of concept only3
No public exploit1
20062008201020122014201620182020202220242026
| CVE | Severity | Published▾ | Status | Exploitation | Description |
|---|---|---|---|---|---|
| CVE-2026-29925 | High | 2026-03-30 | Not applicable | Proof of concept only | Invoice Ninja v5.12.46 and v5.12.48 is vulnerable to Server-Side Request Forgery (SSRF) in CheckDatabaseRequest.php. |
| CVE-2026-33742 | Medium | 2026-03-26 | Not applicable | Proof of concept only | Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Product notes fields in Invoice Ninja v5.13.0 allow raw HTML via Markdown rendering, enabling stored XSS. The Markdown parser output was not sanitized with `purify::clean()` before being included in invoice templates. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize Markdown output. |
| CVE-2026-33628 | Medium | 2026-03-26 | Not applicable | Proof of concept only | Invoice Ninja is a source-available invoice, quote, project and time-tracking app built with Laravel. Invoice line item descriptions in Invoice Ninja v5.13.0 bypass the XSS denylist filter, allowing stored XSS payloads to execute when invoices are rendered in the PDF preview or client portal. The line item description field was not passed through `purify::clean()` before rendering. This is fixed in v5.13.4 by the vendor by adding `purify::clean()` to sanitize line item descriptions. |
| CVE-2025-14072 | Medium | 2026-01-02 | Not applicable | No public exploit | The Ninja Forms WordPress plugin before 3.13.3 allows unauthenticated attackers to generate valid access tokens via the REST API which can then be used to read form submissions. |
| CVE-2025-11924 | High | 2025-12-17 | Not applicable | Exploited | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Insecure Direct Object Reference in versions up to, and including, 3.13.2. This is due to the plugin not properly verifying that a user is authorized before the `ninja-forms-views` REST endpoints return form metadata and submission content. This makes it possible for unauthenticated attackers to read arbitrary form definitions and submission records via a leaked bearer token granted they can load any page containing the Submissions Table block. NOTE: The developer released a patch for this issue in 3.13.1, but inadvertently introduced a REST API endpoint in which a valid bearer token could be minted for arbitrary form IDs, making this patch ineffective. |
| CVE-2025-10499 | Medium | 2025-09-27 | Not applicable | No public exploit | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation on the maybe_opt_in() function. This makes it possible for unauthenticated attackers to opt an affected site into usage statistics collection via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
| CVE-2025-10498 | Medium | 2025-09-27 | Not applicable | No public exploit | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 3.12.0. This is due to missing or incorrect nonce validation when exporting CSV files. This makes it possible for unauthenticated attackers to delete those files granted they can trick an administrator into performing an action such as clicking on a link. |
| CVE-2025-9083 | Critical | 2025-09-18 | Not applicable | Proof of concept only | The Ninja Forms WordPress plugin before 3.11.1 unserializes user input via form field, which could allow Unauthenticated users to perform PHP Object Injection when a suitable gadget is present on the blog. |
| CVE-2025-5398 | Medium | 2025-06-27 | Not applicable | No public exploit | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the use of a templating engine in all versions up to, and including, 3.10.2.1 due to insufficient output escaping on user data passed through the template. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2025-2940 | High | 2025-06-27 | Not applicable | No public exploit | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 5.0.18 via the args[url] parameter. This makes it possible for unauthenticated attackers to make web requests to arbitrary locations originating from the web application and can be used to query and modify information from internal services. |
| CVE-2025-2939 | Medium | 2025-06-03 | Not applicable | No public exploit | The Ninja Tables – Easy Data Table Builder plugin for WordPress is vulnerable to PHP Object Injection in all versions up to, and including, 5.0.18 via deserialization of untrusted input from the args[callback] parameter . This makes it possible for unauthenticated attackers to inject a PHP Object. The additional presence of a POP chain allows attackers to execute arbitrary functions, though it does not allow user supplied parameters only single functions can be called so the impact is limited. |
| CVE-2025-2561 | Medium | 2025-05-19 | Not applicable | Proof of concept only | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). |
| CVE-2025-2560 | Medium | 2025-05-19 | Not applicable | Proof of concept only | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). |
| CVE-2025-2524 | Medium | 2025-05-19 | Not applicable | Proof of concept only | The Ninja Forms WordPress plugin before 3.10.1 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). |
| CVE-2025-1454 | Medium | 2025-05-15 | Not applicable | Proof of concept only | The Ninja Pages WordPress plugin through 1.4.2 does not sanitise and escape some of its settings, which could allow high privilege users such as admin to perform Stored Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed (for example in multisite setup). |
| CVE-2024-12772 | Medium | 2025-01-31 | Not applicable | Proof of concept only | The Ninja Tables WordPress plugin before 5.0.17 does not sanitize and escape a parameter before outputting it back in the page when importing a CSV, leading to a Cross Site Scripting vulnerability. |
| CVE-2024-13470 | Medium | 2025-01-30 | Not applicable | No public exploit | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the plugin's shortcode in all versions up to, and including, 3.8.24 due to insufficient input sanitization and output escaping on user supplied attributes. This makes it possible for authenticated attackers, with contributor-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-12238 | Medium | 2024-12-29 | Not applicable | No public exploit | The The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to arbitrary shortcode execution in all versions up to, and including, 3.8.22. This is due to the software allowing users to execute an action that does not properly validate a value before running do_shortcode. This makes it possible for authenticated attackers, with Subscriber-level access and above, to execute arbitrary shortcodes. |
| CVE-2024-11052 | High | 2024-12-12 | Not applicable | No public exploit | The Ninja Forms – The Contact Form Builder That Grows With You plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the calculations parameter in all versions up to, and including, 3.8.19 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-50515 | Medium | 2024-11-19 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16. |
| CVE-2024-50514 | Medium | 2024-11-19 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Kevin Stover Ninja Forms ninja-forms allows Stored XSS.This issue affects Ninja Forms: from n/a through <= 3.8.16. |
| CVE-2024-10717 | Medium | 2024-11-13 | Not applicable | No public exploit | The Styler for Ninja Forms plugin for WordPress is vulnerable to unauthorized modification of data that can lead to a denial of service due to a missing capability check on the deactivate_license function in all versions up to, and including, 3.3.4. This makes it possible for authenticated attackers, with Subscriber-level access and above, to delete arbitrary option values on the WordPress site. This can be leveraged to delete an option that would create an error on the site and deny service to legitimate users. Note: This issue can also be used to add arbitrary options with an empty value. |
| CVE-2021-4451 | High | 2024-10-16 | Not applicable | No public exploit | The NinjaFirewall plugin for WordPress is vulnerable to Authenticated PHAR Deserialization in versions up to, and including, 4.3.3. This allows authenticated attackers to perform phar deserialization on the server. This deserialization can allow other plugin or theme exploits if vulnerable software is present (WordPress, and NinjaFirewall). |
| CVE-2024-3866 | Medium | 2024-09-25 | Not applicable | No public exploit | The Ninja Forms Contact Form plugin for WordPress is vulnerable to Reflected Self-Based Cross-Site Scripting via the 'Referer' header in all versions up to, and including, 3.8.15 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that execute if they can successfully trick a user into performing an action such as clicking on a link. Successful exploitation of this vulnerability requires "maintenance mode" for a targeted form to be enabled. However, there is no setting available to the attacker or even an administrator-level user to enable this mode. The mode is only enabled during a required update, which is a very short window of time. Additionally, because of the self-based nature of this vulnerability, attackers would have to rely on additional techniques to execute a supplied payload in the context of targeted user. |
| CVE-2024-43999 | Medium | 2024-09-18 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Saturday Drive Ninja Forms allows Stored XSS.This issue affects Ninja Forms: from n/a through 3.8.11. |
| CVE-2024-1596 | High | 2024-09-07 | Not applicable | No public exploit | The Ninja Forms - File Uploads plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an uploaded file (e.g. RTX file) in all versions up to, and including, 3.3.16 due to insufficient input sanitization and output escaping. This makes it possible for unauthenticated attackers to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-7354 | Medium | 2024-09-02 | Not applicable | Working exploit published | The Ninja Forms WordPress plugin before 3.8.11 does not escape an URL before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin |
| CVE-2024-7304 | Medium | 2024-08-27 | Not applicable | No public exploit | The Ninja Tables – Easiest Data Table Builder plugin for WordPress is vulnerable to Stored Cross-Site Scripting via SVG File uploads in all versions up to, and including, 5.0.12 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses the SVG file. |
| CVE-2024-39628 | High | 2024-08-26 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in Saturday Drive Ninja Forms allows Cross Site Request Forgery.This issue affects Ninja Forms: from n/a through 3.8.6. |
| CVE-2024-37244 | Medium | 2024-07-22 | Not applicable | No public exploit | Improper Neutralization of Input During Web Page Generation (XSS or 'Cross-site Scripting') vulnerability in Ninja Team Ninja Beaver Add-ons for Beaver Builder allows Stored XSS.This issue affects Ninja Beaver Add-ons for Beaver Builder: from n/a through 2.4.5. |
| CVE-2024-37934 | Critical | 2024-07-09 | Not applicable | No public exploit | Improper Control of Generation of Code ('Code Injection') vulnerability in Saturday Drive Ninja Forms allows Code Injection.This issue affects Ninja Forms: from n/a through 3.8.4. |
| CVE-2023-38393 | High | 2024-06-19 | Not applicable | Proof of concept only | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. |
| CVE-2023-38386 | Critical | 2024-06-19 | Not applicable | No public exploit | Missing Authorization vulnerability in Saturday Drive Ninja Forms.This issue affects Ninja Forms: from n/a through 3.6.25. |
| CVE-2024-23504 | Medium | 2024-06-14 | Not applicable | No public exploit | Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.5. |
| CVE-2024-23503 | Medium | 2024-06-11 | Not applicable | No public exploit | Missing Authorization vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.6. |
| CVE-2024-35635 | Medium | 2024-06-03 | Not applicable | No public exploit | Server-Side Request Forgery (SSRF) vulnerability in WPManageNinja LLC Ninja Tables.This issue affects Ninja Tables: from n/a through 5.0.9. |
| CVE-2023-36505 | High | 2024-04-17 | Not applicable | No public exploit | Improper Input Validation vulnerability in Saturday Drive Ninja Forms Contact Form.This issue affects Ninja Forms Contact Form : from n/a through 3.6.24. |
| CVE-2024-29220 | Medium | 2024-04-11 | Not applicable | No public exploit | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in custom fields for labels. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product. |
| CVE-2024-26019 | Medium | 2024-04-11 | Not applicable | No public exploit | Ninja Forms prior to 3.8.1 contains a cross-site scripting vulnerability in submit processing. If this vulnerability is exploited, an arbitrary script may be executed on the web browser of the user who is accessing to the website using the product. |
| CVE-2024-25572 | High | 2024-04-11 | Not applicable | No public exploit | Cross-site request forgery (CSRF) vulnerability exists in Ninja Forms prior to 3.4.31. If a website administrator views a malicious page while logging in, unintended operations may be performed. |
| CVE-2024-2113 | Medium | 2024-03-29 | Not applicable | No public exploit | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 3.8.0. This is due to missing or incorrect nonce validation on the nf_download_all_subs AJAX action. This makes it possible for unauthenticated attackers to trigger an export of a form's submission to a publicly accessible location via a forged request granted they can trick a site administrator into performing an action such as clicking on a link. |
| CVE-2024-2108 | Medium | 2024-03-29 | Not applicable | No public exploit | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Stored Cross-Site Scripting via an image title embedded into a form in all versions up to, and including, 3.8.0 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with author-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. |
| CVE-2024-0685 | Critical | 2024-02-02 | Not applicable | No public exploit | The Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress plugin for WordPress is vulnerable to Second Order SQL Injection via the email address value submitted through forms in all versions up to, and including, 3.7.1 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for unauthenticated attackers to inject SQL in their email address that will append additional into the already existing query when an administrator triggers a personal data export. |
| CVE-2023-37982 | Medium | 2023-12-19 | Not applicable | No public exploit | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Salesforce and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.3.3. |
| CVE-2023-47779 | Medium | 2023-12-07 | Not applicable | No public exploit | URL Redirection to Untrusted Site ('Open Redirect') vulnerability in CRM Perks. Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms.This issue affects Integration for Constant Contact and Contact Form 7, WPForms, Elementor, Ninja Forms: from n/a through 1.1.4. |
| CVE-2023-35909 | Medium | 2023-12-07 | Not applicable | No public exploit | Uncontrolled Resource Consumption vulnerability in Saturday Drive Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress leading to DoS.This issue affects Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress: from n/a through 3.6.25. |
| CVE-2023-5601 | Critical | 2023-11-06 | Not applicable | Proof of concept only | The WooCommerce Ninja Forms Product Add-ons WordPress plugin before 1.7.1 does not validate the file to be uploaded, allowing any unauthenticated users to upload arbitrary files to the server, leading to RCE. |
| CVE-2023-5530 | Medium | 2023-11-06 | Not applicable | No public exploit | The Ninja Forms Contact Form WordPress plugin before 3.6.34 does not sanitize and escape its label fields, which could allow high privilege users such as admin to perform Stored XSS attacks. Only users with the unfiltered_html capability can perform this, and such users are already allowed to use JS in posts/comments etc however the vendor acknowledged and fixed the issue |
| CVE-2023-4109 | Medium | 2023-08-30 | Not applicable | Proof of concept only | The Ninja Forms WordPress Ninja Forms Contact Form WordPress plugin before 3.6.26 was affected by a HTML Injection security vulnerability. |
| CVE-2022-27861 | Medium | 2023-08-10 | Not applicable | No public exploit | Unauth. Open Redirect vulnerability in Arscode Ninja Popups plugin <= 4.7.5 versions. |
| CVE-2023-37979 | High | 2023-07-27 | Not applicable | Working exploit published | Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Saturday Drive Ninja Forms Contact Form plugin <= 3.6.25 versions. |
| CVE-2023-2333 | Medium | 2023-07-04 | Not applicable | Proof of concept only | The Ninja Forms Google Sheet Connector WordPress plugin before 1.2.7, gsheetconnector-ninja-forms-pro WordPress plugin through 1.2.7 does not escape a parameter before outputting it back in an attribute, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin |
| CVE-2021-4336 | Critical | 2023-05-28 | Not applicable | No public exploit | A vulnerability was found in ITRS Group monitor-ninja up to 2021.11.1. It has been rated as critical. Affected by this issue is some unknown functionality of the file modules/reports/models/scheduled_reports.php. The manipulation leads to sql injection. Upgrading to version 2021.11.30 is able to address this issue. The name of the patch is 6da9080faec9bca1ca5342386c0421dca0a6c0cc. It is recommended to upgrade the affected component. The identifier of this vulnerability is VDB-230084. |
| CVE-2022-47136 | High | 2023-05-25 | Not applicable | No public exploit | Cross-Site Request Forgery (CSRF) vulnerability in WPManageNinja LLC Ninja Tables – Best Data Table Plugin for WordPress plugin <= 4.3.4 versions. |
| CVE-2023-1835 | Medium | 2023-05-15 | Not applicable | Working exploit published | The Ninja Forms Contact Form WordPress plugin before 3.6.22 does not properly escape user input before outputting it back in an admin page, leading to a Reflected Cross-Site Scripting which could be used against high privilege users such as admin |
| CVE-2022-47137 | Medium | 2023-05-10 | Not applicable | No public exploit | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in WPManageNinja LLC Ninja Tables plugin <= 4.3.4 versions. |
| CVE-2022-2903 | High | 2022-09-26 | Not applicable | Proof of concept only | The Ninja Forms Contact Form WordPress plugin before 3.6.13 unserialises the content of an imported file, which could lead to PHP object injections issues when an admin import (intentionally or not) a malicious file and a suitable gadget chain is present on the blog. |
| CVE-2022-2544 | High | 2022-08-22 | Not applicable | Working exploit published | The Ninja Job Board WordPress plugin before 1.3.3 does not protect the directory where it stores uploaded resumes, making it vulnerable to unauthenticated Directory Listing which allows the download of uploaded resumes. |
| CVE-2021-25066 | Medium | 2022-07-04 | Not applicable | No public exploit | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitize and escape some imported data, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. |
| CVE-2021-25056 | Medium | 2022-07-04 | Not applicable | No public exploit | The Ninja Forms Contact Form WordPress plugin before 3.6.10 does not sanitise and escape field labels, allowing high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed. |
| CVE-2021-36827 | Medium | 2022-06-16 | Not applicable | No public exploit | Auth. (admin+) Stored Cross-Site Scripting (XSS) vulnerability in Saturday Drive's Ninja Forms Contact Form plugin <= 3.6.9 at WordPress via "label". |
| CVE-2022-0889 | High | 2022-03-23 | Not applicable | No public exploit | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to reflected cross-site scripting due to missing sanitization of the files filename parameter found in the ~/includes/ajax/controllers/uploads.php file which can be used by unauthenticated attackers to add malicious web scripts to vulnerable WordPress sites, in versions up to and including 3.3.12. |
| CVE-2022-0888 | Critical | 2022-03-23 | Not applicable | No public exploit | The Ninja Forms - File Uploads Extension WordPress plugin is vulnerable to arbitrary file uploads due to insufficient input file type validation found in the ~/includes/ajax/controllers/uploads.php file which can be bypassed making it possible for unauthenticated attackers to upload malicious files that can be used to obtain remote code execution, in versions up to and including 3.3.0 |
| CVE-2021-24900 | Medium | 2022-02-01 | Not applicable | No public exploit | The Ninja Tables WordPress plugin before 4.1.8 does not sanitise and escape some of its table fields, which could allow high privilege users to perform Cross-Site Scripting attacks even when the unfiltered_html capability is disallowed |
| CVE-2021-3977 | Medium | 2021-12-24 | Not applicable | No public exploit | invoiceninja is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') |
| CVE-2021-24889 | High | 2021-11-29 | Not applicable | No public exploit | The Ninja Forms Contact Form WordPress plugin before 3.6.4 does not escape keys of the fields POST parameter, which could allow high privilege users to perform SQL injections attacks |
| CVE-2021-34648 | Medium | 2021-09-22 | Not applicable | Exploited | The Ninja Forms WordPress plugin is vulnerable to arbitrary email sending via the trigger_email_action function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to send arbitrary emails from the affected server via the /ninja-forms-submissions/email-action REST API which can be used to socially engineer victims. |
| CVE-2021-34647 | Medium | 2021-09-22 | Not applicable | Exploited | The Ninja Forms WordPress plugin is vulnerable to sensitive information disclosure via the bulk_export_submissions function found in the ~/includes/Routes/Submissions.php file, in versions up to and including 3.5.7. This allows authenticated attackers to export all Ninja Forms submissions data via the /ninja-forms-submissions/export REST API which can include personally identifiable information. |
| CVE-2021-26274 | High | 2021-07-07 | Not applicable | No public exploit | The Agent in NinjaRMM 5.0.909 has Insecure Permissions. |
| CVE-2021-26273 | High | 2021-07-07 | Not applicable | No public exploit | The Agent in NinjaRMM 5.0.909 has Incorrect Access Control. |
| CVE-2021-31516 | High | 2021-06-29 | Not applicable | No public exploit | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BNDB files. The issue results from the lack of validating the existence of an object prior to performing operations on the object. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13670. |
| CVE-2021-31515 | High | 2021-06-29 | Not applicable | No public exploit | This vulnerability allows remote attackers to execute arbitrary code on affected installations of Vector 35 Binary Ninja 2.3.2660 (Build ID 88f343c3). User interaction is required to exploit this vulnerability in that the target must visit a malicious page or open a malicious file. The specific flaw exists within the parsing of BNDB files. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process. Was ZDI-CAN-13668. |
| CVE-2021-33898 | High | 2021-06-06 | Not applicable | No public exploit | In Invoice Ninja before 4.4.0, there is an unsafe call to unserialize() in app/Ninja/Repositories/AccountRepository.php that may allow an attacker to deserialize arbitrary PHP classes. In certain contexts, this can result in remote code execution. The attacker's input must be hosted at http://www.geoplugin.net (cleartext HTTP), and thus a successful attack requires spoofing that site or obtaining control of it. |
| CVE-2021-24166 | Medium | 2021-04-05 | Not applicable | No public exploit | The wp_ajax_nf_oauth_disconnect from the Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 had no nonce protection making it possible for attackers to craft a request to disconnect a site's OAuth connection. |
| CVE-2021-24165 | Medium | 2021-04-05 | Not applicable | Working exploit published | In the Ninja Forms Contact Form WordPress plugin before 3.4.34, the wp_ajax_nf_oauth_connect AJAX action was vulnerable to open redirect due to the use of a user supplied redirect parameter and no protection in place. |
| CVE-2021-24164 | Medium | 2021-04-05 | Not applicable | Exploited | In the Ninja Forms Contact Form WordPress plugin before 3.4.34.1, low-level users, such as subscribers, were able to trigger the action, wp_ajax_nf_oauth, and retrieve the connection url needed to establish a connection. They could also retrieve the client_id for an already established OAuth connection. |
| CVE-2021-24163 | High | 2021-04-05 | Not applicable | No public exploit | The AJAX action, wp_ajax_ninja_forms_sendwp_remote_install_handler, did not have a capability check on it, nor did it have any nonce protection, therefore making it possible for low-level users, such as subscribers, to install and activate the SendWP Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress WordPress plugin before 3.4.34 and retrieve the client_secret key needed to establish the SendWP connection while also installing the SendWP plugin. |
| CVE-2020-36175 | Medium | 2021-01-06 | Not applicable | No public exploit | The Ninja Forms plugin before 3.4.27.1 for WordPress allows attackers to bypass validation via the email field. |
| CVE-2020-36174 | Medium | 2021-01-06 | Not applicable | No public exploit | The Ninja Forms plugin before 3.4.27.1 for WordPress allows CSRF via services integration. |
| CVE-2020-36173 | Medium | 2021-01-06 | Not applicable | No public exploit | The Ninja Forms plugin before 3.4.28 for WordPress lacks escaping for submissions-table fields. |
| CVE-2020-12462 | Medium | 2020-04-29 | Not applicable | No public exploit | The ninja-forms plugin before 3.4.24.2 for WordPress allows CSRF with resultant XSS. |
| CVE-2020-8594 | Medium | 2020-02-14 | Not applicable | No public exploit | The Ninja Forms plugin 3.4.22 for WordPress has Multiple Stored XSS vulnerabilities via ninja_forms[recaptcha_site_key], ninja_forms[recaptcha_secret_key], ninja_forms[recaptcha_lang], or ninja_forms[date_format]. |
| CVE-2014-4550 | Medium | 2019-12-27 | Not applicable | Working exploit published | Cross-site scripting (XSS) vulnerability in preview-shortcode-external.php in the Shortcode Ninja plugin 1.4 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the shortcode parameter. |
| CVE-2018-20981 | Critical | 2019-08-22 | Not applicable | No public exploit | The ninja-forms plugin before 3.3.9 for WordPress has insufficient restrictions on submission-data retrieval during Export Personal Data requests. |
| CVE-2018-20980 | High | 2019-08-22 | Not applicable | No public exploit | The ninja-forms plugin before 3.2.15 for WordPress has parameter tampering. |
| CVE-2017-18574 | Medium | 2019-08-22 | Not applicable | No public exploit | The ninja-forms plugin before 3.0.31 for WordPress has insufficient HTML escaping in the builder. |
| CVE-2019-15025 | Critical | 2019-08-14 | Not applicable | No public exploit | The ninja-forms plugin before 3.3.21.2 for WordPress has SQL injection in the search filter on the submissions page. |
| CVE-2019-10869 | High | 2019-05-07 | Not applicable | Proof of concept only | Path Traversal and Unrestricted File Upload exists in the Ninja Forms plugin before 3.0.23 for WordPress (when the Uploads add-on is activated). This allows an attacker to traverse the file system to access files and execute code via the includes/fields/upload.php (aka upload/submit page) name and tmp_name parameters. |
| CVE-2019-7748 | Medium | 2019-02-11 | Not applicable | No public exploit | _includes\online.php in DbNinja 3.2.7 allows XSS via the data.php task parameter if _users/admin/tasks.php exists. |
| CVE-2019-7747 | Critical | 2019-02-11 | Not applicable | No public exploit | DbNinja 3.2.7 allows session fixation via the data.php sessid parameter. |
| CVE-2019-7545 | Medium | 2019-02-06 | Not applicable | No public exploit | In DbNinja 3.2.7, the Add Host function of the Manage Hosts pages has a Stored Cross-site Scripting (XSS) vulnerability in the User Name field. |
| CVE-2018-19796 | Medium | 2018-12-03 | Not applicable | No public exploit | An open redirect in the Ninja Forms plugin before 3.3.19.1 for WordPress allows Remote Attackers to redirect a user via the lib/StepProcessing/step-processing.php (aka submissions download page) redirect parameter. |
| CVE-2018-19287 | Medium | 2018-11-15 | Not applicable | Working exploit published | XSS in the Ninja Forms plugin before 3.3.18 for WordPress allows Remote Attackers to execute JavaScript via the includes/Admin/Menus/Submissions.php (aka submissions page) begin_date, end_date, or form_id parameter. |
| CVE-2018-16308 | High | 2018-09-01 | Not applicable | No public exploit | The Ninja Forms plugin before 3.3.14.1 for WordPress allows CSV injection. |
| CVE-2018-7280 | Medium | 2018-02-21 | Not applicable | No public exploit | The Ninja Forms plugin before 3.2.14 for WordPress has XSS. |
| CVE-2017-1000466 | Medium | 2018-01-03 | Not applicable | No public exploit | Invoice Ninja version 3.8.1 is vulnerable to stored cross-site scripting vulnerability, within the invoice creation page, which can result in disruption of service and execution of javascript code. |
| CVE-2016-1209 | Critical | 2016-05-14 | Not applicable | Working exploit published | The Ninja Forms plugin before 2.9.42.1 for WordPress allows remote attackers to conduct PHP object injection attacks via crafted serialized values in a POST request. |
| CVE-2015-2220 | Medium | 2015-03-05 | Not applicable | No public exploit | Multiple cross-site scripting (XSS) vulnerabilities in the Ninja Forms plugin before 2.8.9 for WordPress allow (1) remote attackers to inject arbitrary web script or HTML via the ninja_forms_field_1 parameter in a ninja_forms_ajax_submit action to wp-admin/admin-ajax.php or (2) remote administrators to inject arbitrary web script or HTML via the fields[1] parameter to wp-admin/post.php. |
| CVE-2014-9688 | High | 2015-03-05 | Not applicable | No public exploit | Unspecified vulnerability in the Ninja Forms plugin before 2.8.10 for WordPress has unknown impact and remote attack vectors related to admin users. |
| CVE-2014-7757 | Medium | 2014-10-21 | Not applicable | No public exploit | The Awful Ninja Game (aka com.absolutelyawfulapplications.awfulninjagame) application 1.0.23 for Android does not verify X.509 certificates from SSL servers, which allows man-in-the-middle attackers to spoof servers and obtain sensitive information via a crafted certificate. |