cyberlord92 Vulnerabilities and Affected Products
Vulnerabilities associated with Web3 – Crypto wallet Login & NFT token gating.
Products
Clear product- Active Directory Integration / LDAP Integration4 vulnerabilities
- Miniorange OTP Verification with Firebase4 vulnerabilities
- OAuth Single Sign On – SSO (OAuth Client)4 vulnerabilities
- miniOrange Social Login and Register (Discord, Google, Twitter, LinkedIn)3 vulnerabilities
- Page and Post Restriction3 vulnerabilities
- Broken Link Checker | Finder2 vulnerabilities
- Employee Directory – Staff Directory and Listing2 vulnerabilities
- Integrate Dynamics 365 CRM2 vulnerabilities
- PowerBI Embed Reports2 vulnerabilities
- SAML Single Sign On – SSO Login2 vulnerabilities
- Web Application Firewall – website security2 vulnerabilities
- All-in-One Microsoft 365 & Entra ID / Azure AD SSO Login1 vulnerability
- Login with YourMembership – YM SSO Login1 vulnerability
- login_using_wordpress_users1 vulnerability
- Malware Scanner1 vulnerability
- miniOrange 2FA – Two-Factor Authentication for WordPress (SMS, Email & Google Authenticator)1 vulnerability
- miniOrange OTP Login, Verification and SMS Notifications1 vulnerability
- miniOrange OTP Verification and SMS Notification for WooCommerce1 vulnerability
- Password Policy Manager | Password Manager1 vulnerability
- SAML IDP (Identity Provider) – Login with Website Users1 vulnerability
- Staff/Employee Business Directory for Active Directory1 vulnerability
- User Sync1 vulnerability
- Web3 – Crypto wallet Login & NFT token gating1 vulnerability
- WordPress Single Sign-On (SSO) - Multisite All-Inclusive1 vulnerability
- WordPress Single Sign-On (SSO) - Multisite Enterprise1 vulnerability
| Vulnerability | Title and context | CVSS | EPSS | PoCs | Signals | STIX action |
|---|---|---|---|---|---|---|
CVE-2023-3249CRITICAL | Web3 – Crypto wallet Login & NFT token gating <= 2.6.0 - Authentication BypassThe Web3 – Crypto wallet Login & NFT token gating plugin for WordPress is vulnerable to authentication bypass in versions up to, and including, 2.6.0. This is due to incorrect authentication checking in the 'hidden_form_data' function. This makes it possible for authenticated attackers to log in as any existing user on the site, such as an administrator, if they have access to the username. CWE-288Jun 30, 2023 | CVSS9.8v3.1 | EPSS1.11% | PoCs0 | SignalsNot listed in CISA KEVNo known ransomware useNo Nuclei templates | STIX |