church_admin_project - MidnightBSD Security Advisories

CVE-2015-4127 MEDIUM

Cross-site scripting (XSS) vulnerability in the church_admin plugin before 0.810 for WordPress allows remote attackers to inject arbitrary web script or HTML via the address parameter, as demonstrated by a request to index.php/2015/05/21/church_admin-registration-form/.

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-79,

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2022-0833 MEDIUM

The Church Admin WordPress plugin before 3.4.135 does not have authorisation and CSRF in some of its action as well as requested files, allowing unauthenticated attackers to repeatedly request the "refresh-backup" action, and simultaneously keep requesting a publicly accessible temporary file generated by the plugin in order to disclose the final backup filename, which can then be fetched by the attacker to download the backup of the plugin's DB data

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
nvd@nist.gov	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N	2.8	1.4

CVSS 2.0

Severity: MEDIUM

Problem Type: CWE-352,CWE-862,

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2023-34021

Unauth. Reflected Cross-Site Scripting (XSS) vulnerability in Andy Moyle Church Admin plugin <= 3.7.29 versions.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	7.1	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L	2.8	3.7

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2023-38515

Server-Side Request Forgery (SSRF) vulnerability in Andy Moyle Church Admin.This issue affects Church Admin: from n/a through 3.7.56.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	5.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N	2.3	2.7
nvd@nist.gov	4.9	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N	1.2	3.6

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-30193

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.17.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L	2.3	3.7

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-30197

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.26.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L	2.3	3.7

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-30244

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	8.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:L	3.1	4.7

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-30493

Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.7.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-30505

Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.18.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	5.4	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:L	2.8	2.5

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-31280

Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.5.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	9.9	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	3.1	6.0

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-31281

Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	6.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L	2.8	3.4

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-32090

Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.0.27.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-34828

Cross-Site Request Forgery (CSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.1.32.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-35637

Server-Side Request Forgery (SSRF) vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.3.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	4.4	MEDIUM	CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:L/I:L/A:N	1.3	2.7

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-35764

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	6.5	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:L	2.3	3.7

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-37418

Unrestricted Upload of File with Dangerous Type vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.6.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	9.9	CRITICAL	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H	3.1	6.0

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

CVE-2024-37440

Missing Authorization vulnerability in andy_moyle Church Admin church-admin.This issue affects Church Admin: from n/a through <= 4.4.4.

CVSS 3.x

Source	Score	Severity	Vector	Exploitability	Impact
audit@patchstack.com	4.3	MEDIUM	CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N	2.8	1.4

Products Affected

Vendor	Product	Version
church_admin_project	church_admin	*

Advisories for church_admin_project