vanguard project vulnerabilities

Products

• marketplace digital products php 4
• vanguard 1

Latest vanguard project CVEs

Newest publication first

1. CVE-2020-15537 Vanguard - Marketplace Digital Products PHP7 <= 2.1 - Cross-Site Scripting

   Published 2020-07-05

   Medium·CVSS 6.1 EPSS 1.2%

   An issue was discovered in the Vanguard plugin 2.1 for WordPress. XSS can occur via the mails/new title field, a product field to the p/ URI, or the Products Search box.

2. CVE-2017-17937 Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.

   Published 2017-12-28

   Medium·CVSS 6.1 EPSS 0.62%

   Vanguard Marketplace Digital Products PHP has XSS via the phps_query parameter to /search.

3. CVE-2017-17936 Vanguard Marketplace Digital Products PHP has CSRF via /search.

   Published 2017-12-28

   High·CVSS 8.8 EPSS 0.46%

   Vanguard Marketplace Digital Products PHP has CSRF via /search.

4. CVE-2017-17873 Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.

   Published 2017-12-24

   Critical·CVSS 9.8 EPSS 2.7% Public exploit

   Vanguard Marketplace Digital Products PHP 1.4 has SQL Injection via the PATH_INFO to the /p URI.

5. CVE-2017-17874 Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI.

   Published 2017-12-24

   High·CVSS 8.8 EPSS 6.0% Public exploit

   Vanguard Marketplace Digital Products PHP 1.4 allows arbitrary file upload via an "Add a new product" or "Add a product preview" action, which can make a .php file accessible under a uploads/ URI.

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.