Xnau
Xnau Participants Database: vulnerabilidades y CVE
Xnau Participants Database tiene 14 vulnerabilidades publicadas, 6 de ellas en los últimos 12 meses. 4 son críticas y 0 figuran en el catálogo de explotación activa de CISA.
CVE14
Últimos 12 meses6
Críticas4
Explotadas activamente0
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-28189 | Alta (7.4) | 0.43% | — | 13 ago 2026 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.4 versions. |
| CVE-2026-13596 | Crítica (9.1) | 0.46% | — | 1 ago 2026 | The Participants Database WordPress plugin before 2.7.8.4 does not properly sanitize and escape a user-supplied parameter before using it in a SQL query, allowing unauthenticated attackers to perform SQL injection… |
| CVE-2026-11354 | Media (5.3) | 0.42% | — | 24 jul 2026 | The Participants Database plugin for WordPress is vulnerable to Sensitive Information Exposure in all versions up to, and including, 2.7.8.3 via the 'id' parameter. This makes it possible for unauthenticated attackers… |
| CVE-2026-59555 | Crítica (10) | 0.60% | — | 23 jul 2026 | Unauthenticated Arbitrary File Deletion in Participants Database <= 2.7.8.3 versions. |
| CVE-2026-59525 | Crítica (9.3) | 0.40% | — | 23 jul 2026 | Unauthenticated SQL Injection in Participants Database <= 2.7.8.3 versions. |
| CVE-2026-27423 | Media (4.3) | 0.25% | — | 23 jul 2026 | Subscriber Broken Access Control in Participants Database <= 2.7.8.4 versions. |
| CVE-2025-58008 | Media (6.5) | 0.21% | — | 22 sept 2025 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in xnau webdesign Participants Database participants-database allows Stored XSS.This issue affects Participants… |
| CVE-2024-43141 | Crítica (9.8) | 0.65% | — | 13 ago 2024 | Deserialization of Untrusted Data vulnerability in Roland Barker, xnau webdesign Participants Database allows Object Injection.This issue affects Participants Database: from n/a through 2.5.9.2. |
| CVE-2023-48751 | Alta (8.8) | 0.25% | — | 19 dic 2023 | Missing Authorization, Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database allows Accessing Functionality Not Properly Constrained by ACLs, Cross Site Request… |
| CVE-2023-31235 | Alta (8.8) | 0.34% | — | 9 nov 2023 | Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.9 versions. |
| CVE-2022-47612 | Media (4.3) | 0.23% | — | 28 feb 2023 | Cross-Site Request Forgery (CSRF) vulnerability in Roland Barker, xnau webdesign Participants Database plugin <= 2.4.5 leads to list column update. |
| CVE-2020-8596 | Alta (7.5) | 1.6% | — | 11 feb 2020 | participants-database.php in the Participants Database plugin 1.9.5.5 and previous versions for WordPress has a time-based SQL injection vulnerability via the ascdesc, list_filter_count, or sortBy parameters. It is… |
| CVE-2017-14126 | Media (6.1) | 2.3% | — | 4 sept 2017 | The Participants Database plugin before 1.7.5.10 for WordPress has XSS. |
| CVE-2014-3961 | Alta (7.5) | 5.6% | — | 4 jun 2014 | SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV"… |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.