Wordfence Intelligence   >   Vulnerability Researchers   >   Rafie Muhammad

Rafie Muhammad

Organization: Patchstack

2
All Time Ranking
392
All Time Discoveries

Showing 61-80 of 392 Vulnerabilities

ARMember <= 4.0.22 - Cross-Site Request Forgery
6.3
CVE-2023-52200
Jan 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_upload
9.8
CVE-2023-51409
Jan 9, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated Arbitrary File Upload via uploadFile
9.8
CVE-2023-52221
Jan 8, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated SQL Injection via userToken
9.8
CVE-2023-52215
Jan 8, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ActivityPub <= 1.0.5 - Missing Authorization
5.3
CVE-2023-52199
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Google Analytics by Monster Insights <= 8.21.0 - Missing Authorization
4.3
CVE-2023-52220
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
WooCommerce <= 8.2.2 - Cross-Site Request Forgery
4.3
CVE-2023-52222
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WP Job Manager <= 2.0.0 - Cross-Site Request Forgery
4.3
CVE-2023-52212
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WP Job Manager <= 2.0.0 - Missing Authorization
5.3
CVE-2023-52211
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Gecka Terms Thumbnails <= 1.1 - Authenticated (Subscriber+) PHP Object Injection
8.8
CVE-2023-52219
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Taggbox <= 3.1 - Unauthenticated PHP Object Injection
9.8
CVE-2023-52225
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
WooCommerce Tranzila Gateway <= 1.0.8 - Unauthenticated PHP Object Injection
9.8
CVE-2023-52218
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
HTML5 MP3 Player with Folder Feedburner <= 2.8.0 - Authenticated (Author+) PHP Object Injection
8.8
CVE-2023-52202
Jan 3, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HTML5 MP3 Player with Playlist Free <= 3.0.0 - Authenticated (Author+) PHP Object Injecton
8.8
CVE-2023-52207
Jan 3, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
HTML5 SoundCloud Player <= 2.8.0 - Authenticated (Author+) PHP Object Injection
8.8
CVE-2023-52205
Jan 3, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
WooCommerce Product Vendors <= 2.2.2 - Missing Authorization
5.3
CVE-2023-52186
Dec 29, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
ARI Stream Quiz <= 1.3.0 - Authenticated (Contributor+) PHP Object Injection
8.8
CVE-2023-52182
Dec 29, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Theme per user <= 1.0.1 - Unauthenticated PHP Object Injection
9.8
CVE-2023-52181
Dec 29, 2023
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
YITH WooCommerce Product Add-Ons <= 4.3.0 - Authenticated(Shop Manager+) PHP Object Injection
6.6
CVE-2023-49777
Dec 28, 2023
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
JVM rich text icons <= 1.2.6 - Directory Traversal to Authenticated(Subscriber+) Arbitrary File Deletion
8.8
CVE-2023-51418
Dec 27, 2023
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
ARMember <= 4.0.22 - Cross-Site Request Forgery CVE-2023-52200 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L January 11, 2024
AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_upload CVE-2023-51409 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 9, 2024
Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated Arbitrary File Upload via uploadFile CVE-2023-52221 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 8, 2024
Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated SQL Injection via userToken CVE-2023-52215 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 8, 2024
ActivityPub <= 1.0.5 - Missing Authorization CVE-2023-52199 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N January 5, 2024
Google Analytics by Monster Insights <= 8.21.0 - Missing Authorization CVE-2023-52220 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 5, 2024
WooCommerce <= 8.2.2 - Cross-Site Request Forgery CVE-2023-52222 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 5, 2024
WP Job Manager <= 2.0.0 - Cross-Site Request Forgery CVE-2023-52212 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 5, 2024
WP Job Manager <= 2.0.0 - Missing Authorization CVE-2023-52211 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N January 5, 2024
Gecka Terms Thumbnails <= 1.1 - Authenticated (Subscriber+) PHP Object Injection CVE-2023-52219 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 5, 2024
Taggbox <= 3.1 - Unauthenticated PHP Object Injection CVE-2023-52225 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 5, 2024
WooCommerce Tranzila Gateway <= 1.0.8 - Unauthenticated PHP Object Injection CVE-2023-52218 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 5, 2024
HTML5 MP3 Player with Folder Feedburner <= 2.8.0 - Authenticated (Author+) PHP Object Injection CVE-2023-52202 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 3, 2024
HTML5 MP3 Player with Playlist Free <= 3.0.0 - Authenticated (Author+) PHP Object Injecton CVE-2023-52207 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 3, 2024
HTML5 SoundCloud Player <= 2.8.0 - Authenticated (Author+) PHP Object Injection CVE-2023-52205 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 3, 2024
WooCommerce Product Vendors <= 2.2.2 - Missing Authorization CVE-2023-52186 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N December 29, 2023
ARI Stream Quiz <= 1.3.0 - Authenticated (Contributor+) PHP Object Injection CVE-2023-52182 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H December 29, 2023
Theme per user <= 1.0.1 - Unauthenticated PHP Object Injection CVE-2023-52181 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H December 29, 2023
YITH WooCommerce Product Add-Ons <= 4.3.0 - Authenticated(Shop Manager+) PHP Object Injection CVE-2023-49777 6.6 CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H December 28, 2023
JVM rich text icons <= 1.2.6 - Directory Traversal to Authenticated(Subscriber+) Arbitrary File Deletion CVE-2023-51418 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H December 27, 2023

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation