Faqs Manager Vulnerabilities

The FAQs Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the inic_faq_settings function. This makes it possible for unauthenticated attackers to arbitrarily change plugin settings via a forged request...

CVSS:

8.8

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Mar 22, 2013

The FAQs Manager plugin for WordPress is vulnerable to blind SQL Injection via the ‘order’ and 'orderby' parameters in versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated att...

CVSS:

7.2

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Mar 22, 2013

The FAQs Manager plugin for WordPress is vulnerable to Cross-Site Scripting via the 'question' parameter in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

CVSS:

6.1

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Mar 22, 2013

IndiaNIC FAQs Manager Plugin is prone to a CSRF and XSS vulnerabilities, also, the Captcha value can be read from captcha parameter (hidden field). Update the plugin.

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Mar 22, 2013

IndiaNIC FAQs Manager plugin is prone to a Blind SQL injection. This vulnerability allows an attacker to modify data, alter queries to the application SQL database, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Update the plugin.

Affected:

up to 1.1

Fixed in:

1.1

Disclosed:

Mar 22, 2013

The FAQs Manager plugin for WordPress is vulnerable to blind SQL Injection via the ‘order’ and 'orderby' parameters in versions up to, and including, 1.0 due to insufficient escaping on the user supplied parameter and lack of sufficient preparation on the existing SQL query. This makes it possible for authenticated att...

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Mar 22, 2013

The FAQs Manager plugin for WordPress is vulnerable to Cross-Site Scripting via the 'question' parameter in versions up to, and including, 1.0 due to insufficient input sanitization and output escaping. This makes it possible for attackers to inject arbitrary web scripts that execute in a victim's browser.

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Mar 22, 2013

The FAQs Manager plugin for WordPress is vulnerable to Cross-Site Request Forgery in versions up to, and including, 1.0. This is due to missing or incorrect nonce validation on the inic_faq_settings function. This makes it possible for unauthenticated attackers to arbitrarily change plugin settings via a forged request...

Affected:

up to 1.0

Fix:

No patched version reported

Disclosed:

Mar 22, 2013

The faqs-manager WordPress plugin was affected by an Ask Question Form question Parameter XSS security vulnerability.

Affected:

up to 1.0

Fix:

No patched version reported

The faqs-manager WordPress plugin was affected by a Blind SQL Injection security vulnerability.

Affected:

up to 1.0

Fix:

No patched version reported

Affected:

up to 1.0

Fix:

No patched version reported

The faqs-manager WordPress plugin was affected by a FAQ Setting Manipulation CSRF security vulnerability.

Affected:

up to 1.0

Fix:

No patched version reported