skymoonlabs vulnerabilities

Products

• moveto 4
• cleanto 2

Latest skymoonlabs CVEs

Newest publication first

1. CVE-2024-25911 WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary File Deletion vulnerability

   Published 2024-04-16

   High·CVSS 8.6 EPSS 0.53%

   Missing Authorization vulnerability in Skymoon Labs MoveTo.This issue affects MoveTo: from n/a through 6.2.

2. CVE-2024-25912 WordPress MoveTo plugin <= 6.2 - Unauthenticated Arbitrary WordPress Settings Change vulnerability

   Published 2024-03-21

   Critical·CVSS 9.8 EPSS 0.58%

   Missing Authorization vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.

3. CVE-2024-25910 WordPress MoveTo Plugin <= 6.2 is vulnerable to SQL Injection

   Published 2024-02-28

   Critical·CVSS 9.8 EPSS 0.57%

   Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.

4. CVE-2024-25913 WordPress MoveTo Plugin <= 6.2 is vulnerable to Arbitrary File Upload

   Published 2024-02-26

   Critical·CVSS 9.8 EPSS 0.63%

   Unrestricted Upload of File with Dangerous Type vulnerability in Skymoonlabs MoveTo.This issue affects MoveTo: from n/a through 6.2.

5. CVE-2019-6296 Cleanto 5.0 has SQL Injection via the assets/lib/export_ajax.php id parameter.

   Published 2019-01-15

   Critical·CVSS 9.8 EPSS 1.3%

   Cleanto 5.0 has SQL Injection via the assets/lib/export_ajax.php id parameter.

6. CVE-2019-6295 Cleanto 5.0 has SQL Injection via the assets/lib/service_method_ajax.php service_id parameter.

   Published 2019-01-15

   Critical·CVSS 9.8 EPSS 1.3%

   Cleanto 5.0 has SQL Injection via the assets/lib/service_method_ajax.php service_id parameter.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.