The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to unauthorized modification/deletion of data due to a missing capability check on the delete_single_account() function in versions up to, and including, 1.2.0. The REST route 'devs-...
Vendor
ajitdas vulnerabilities
6 published CVES affecting ajitdas, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).
- Total
- 6
- Critical
- 2
- High
- 0
- Medium
- 4
- Low
- 0
- Unscored
- 0
- CISA KEV
- 0
Products
- Devs Accounting – Simple Accounting and Invoicing Solution 2
- Devs CRM – Manage tasks, attendance and teams all together 2
- Flex QR Code Generator 2
Latest ajitdas CVEs
Newest publication first
-
MediumCVSS 5.3 EPSS 0.39%
-
MediumCVSS 5.3 EPSS 0.49%
The Devs Accounting – Simple Accounting and Invoicing Solution plugin for WordPress is vulnerable to Missing Authorization in all versions up to, and including, 1.2.0. This is due to the get_single_account() REST API callback being registered with a permission_callback that uncon...
-
MediumCVSS 5.3 EPSS 0.29%
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the /wp-json/devs-crm/v1/attendances REST API Endpoint in all versions up to, and including, 1.1.8. This makes it...
-
MediumCVSS 5.3 EPSS 0.27%
The Devs CRM – Manage tasks, attendance and teams all together plugin for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the '/wp-json/devs-crm/v1/bulk-update' REST-API endpoint in all versions up to, and including, 1.1.8. This m...
-
CriticalCVSS 9.8 EPSS 0.79%
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the update_qr_code() function in all versions up to, and including, 1.2.7. This makes it possible for unauthenticated attackers to upload arbitrary files...
-
CriticalCVSS 9.8 EPSS 0.92%
The Flex QR Code Generator plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in thesave_qr_code_to_db() function in all versions up to, and including, 1.2.5. This makes it possible for unauthenticated attackers to upload arbitrary fi...
Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.