Advisories · Technology
shabti Frontend Admin by DynamiApps.
Every CVE that names shabti Frontend Admin by DynamiApps among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.
- CVSS 6.4 Medium
Frontend Admin by DynamiApps <= 3.28.36 - Authenticated (Contributor+) Stored Cross-Site Scripting via Post Content
- shabti Frontend Admin by DynamiApps
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Account Takeover via '_acf_objects' Object Identifier
- shabti Frontend Admin by DynamiApps
- Authentication bypass
- CVSS 6.4 Medium
Frontend Admin by DynamiApps <= 3.29.11 - Authenticated (Contributor+) Stored Cross-Site Scripting via 'tag' Shortcode Attribute
- shabti Frontend Admin by DynamiApps
- Cross-site scripting (XSS)
- CVSS 7.5 High
Frontend Admin by DynamiApps <= 3.29.12 - Unauthenticated Arbitrary File Deletion via Path Traversal via custom_directory_name Merge Tag
- shabti Frontend Admin by DynamiApps
- Path traversal
- CVSS 9.8 CriticalCritical · CVSS 9+
Frontend Admin by DynamiApps <= 3.29.9 - Unauthenticated Privilege Escalation via 'item_id' Parameter
- shabti Frontend Admin by DynamiApps
- Privilege escalation
- CVSS 8.8 High
Frontend Admin by DynamiApps <= 3.29.9 - Authenticated (Subscriber+) Arbitrary Password Reset via Encrypted Object Token
- shabti Frontend Admin by DynamiApps
- Broken access control
- CVSS 4.9 Medium
Frontend Admin by DynamiApps <= 3.28.28 - Authenticated (Administrator+) SQL Injection via 'order' Parameter
- shabti Frontend Admin by DynamiApps
- SQL injection
- CVSS 8.8 High
Frontend Admin by DynamiApps <= 3.29.2 - Unauthenticated Privilege Escalation via Form Configuration Injection
- shabti Frontend Admin by DynamiApps
- Privilege escalation
- CVSS 8.8 High
Frontend Admin by DynamiApps <= 3.29.2 - Missing Authorization to Authenticated (Subscriber+) Account Takeover via 'user_id' URL Query Parameter
- shabti Frontend Admin by DynamiApps
- Broken access control
- CVSS 8.8 High
Frontend Admin by DynamiApps <= 3.28.36 - Unauthenticated Privilege Escalation via Edit User Form
- shabti Frontend Admin by DynamiApps
- Privilege escalation
- CVSS 7.2 High
Frontend Admin by DynamiApps <= 3.28.31 - Authenticated (Editor+) PHP Object Injection via 'post_content' of Admin Form Posts
- shabti Frontend Admin by DynamiApps
- Insecure deserialization
- CVSS 9.1 CriticalCritical · CVSS 9+
Frontend Admin by DynamiApps <= 3.28.25 - Missing Authorization to Unauthenticated Arbitrary Data Deletion via 'delete post' Form Element
- shabti Frontend Admin by DynamiApps
- Broken access control
- CVSS 7.2 High
Frontend Admin by DynamiApps <= 3.28.23 - Unauthenticated Stored Cross-Site Scripting via 'update_field'
- shabti Frontend Admin by DynamiApps
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Frontend Admin by DynamiApps <= 3.28.29 - Unauthenticated Privilege Escalation to Administrator via Role Form Field
- shabti Frontend Admin by DynamiApps
- Privilege escalation
- CVSS 9.8 CriticalCritical · CVSS 9+
Frontend Admin by DynamiApps <= 3.28.20 - Unauthenticated Arbitrary Options Update
- shabti Frontend Admin by DynamiApps
- Broken access control
- CVSS 5.9 Medium
Frontend Admin by DynamiApps <= 3.25.1 - Unauthenticated SQL Injection
- shabti Frontend Admin by DynamiApps
- SQL injection
- CVSS 8.1 High
Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Privilege Escalation
- shabti Frontend Admin by DynamiApps
- Privilege escalation
- CVSS 7.2 High
Frontend Admin by DynamiApps <= 3.24.5 - Unauthenticated Stored Cross-Site Scripting
- shabti Frontend Admin by DynamiApps
- Cross-site scripting (XSS)
- CVSS 9.8 CriticalCritical · CVSS 9+
Frontend Admin by DynamiApps <= 3.19.4 - Improper Missing Encryption Exception Handling to Form Manipulation
- shabti Frontend Admin by DynamiApps
- CWE-636