← Back

Infinitewp

infinitewp

Vendor: Infinitewp • 4 CVEs

CVEs (4)

CVE
VENDORS
PRODUCTS
UPDATED
PUBLISHED
CVSS
CVE-2020-28642
1Infinitewp
1Infinitewp
Nov 21, 2024
Nov 16, 2020
N/A· v4
9.8 CRITICAL· v3
7.5 HIGH· v2
In InfiniteWP Admin Panel before 3.1.12.3, resetPasswordSendMail generates a weak password-reset code, which makes it easier for remote attackers to conduct admin Account Takeover attacks.
CVE-2014-9521
1Infinitewp
1Infinitewp
May 6, 2026
Jan 5, 2015
N/A· v4
N/A· v3
7.5 HIGH· v2
Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a...Show more
Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the uploads directory, as demonstrated by the .php.swp filename.Show less
CVE-2014-9520
1Infinitewp
1Infinitewp
May 6, 2026
Jan 5, 2015
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter.
CVE-2014-9519
1Infinitewp
1Infinitewp
May 6, 2026
Jan 5, 2015
N/A· v4
N/A· v3
7.5 HIGH· v2
SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter.