Skip to content

Vendor

imember360 vulnerabilities

5 published CVES affecting imember360, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
5
Critical
0
High
0
Medium
5
Low
0
Unscored
0
CISA KEV
0
Atom feed of imember360 alerts

Products

Latest imember360 CVEs

Newest publication first

  1. CVE-2014-8948 iMember360 3.8.0.12 - 3.9.001 - Cross-Site Request Forgery

    Published
    MediumCVSS 6.8 EPSS 3.7% Public exploit

    Cross-site request forgery (CSRF) vulnerability in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote attackers to hijack the authentication of administrators for requests that with an unspecified impact via the i4w_trace parameter. NOTE: this can be levera...

  2. CVE-2014-8949 iMember360 3.8.012 - 3.9.001 - Remote Code Execution

    Published
    MediumCVSS 6.0 EPSS 7.5% Public exploit

    The iMember360 plugin 3.8.012 through 3.9.001 for WordPress allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the i4w_trace parameter. NOTE: this can be leveraged with CVE-2014-8948 to allow remote attackers to execute code. NOTE...

  4. CVE-2014-3849 iMember360 3.8.012 - 3.9.001 - Missing Authorization

    Published
    MediumCVSS 4.3 EPSS 6.0% Public exploit

    The iMember360 plugin 3.8.012 through 3.9.001 for WordPress does not properly restrict access, which allows remote attackers to delete arbitrary users via a request containing a user name in the Email parameter and the API key in the i4w_clearuser parameter.

  5. CVE-2014-3842 iMember360is 3.8.012 - 3.9.001 - Cross-Site Scripting

    Published
    MediumCVSS 4.3 EPSS 4.5% Public exploit

    Multiple cross-site scripting (XSS) vulnerabilities in the iMember360 plugin 3.8.012 through 3.9.001 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) decrypt or (2) encrypt parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.