Wordfence Intelligence   >   Vulnerability Researchers   >   Rafie Muhammad

Rafie Muhammad

Organization: Patchstack

2
All Time Ranking
420
All Time Discoveries

Showing 81-100 of 420 Vulnerabilities

Automatic <= 3.92.0 - Unauthenticated SQL Injection
9.8
CVE-2024-27956
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Automatic <= 3.92.0 - Cross-Site Request Forgery to Privilege Escalation
8.8
CVE-2024-27955
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Automatic <= 3.92.0 - Unauthenticated Arbitrary File Download and Server-Side Request Forgery
9.8
CVE-2024-27954
Mar 13, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg'
7.2
CVE-2023-40000
Feb 27, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Brooklyn <= 4.9.7.6 - Reflected Cross-Site Scripting
6.1
CVE-2024-24927
Feb 9, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Brooklyn <= 4.9.7.6 - PHP Object Injection
7.5
CVE-2024-24926
Feb 9, 2024
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H
WooCommerce Box Office <= 1.2.2 - Missing Authorization
4.3
CVE-2024-24799
Jan 31, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
WooCommerce Subscriptions < 5.8.0 - Missing Authorization
4.3
CVE-2023-50850
Jan 17, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
ARMember <= 4.0.22 - Cross-Site Request Forgery
6.3
CVE-2023-52200
Jan 11, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L
AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_upload
9.8
CVE-2023-51409
Jan 9, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated Arbitrary File Upload via uploadFile
9.8
CVE-2023-52221
Jan 8, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated SQL Injection via userToken
9.8
CVE-2023-52215
Jan 8, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
ActivityPub <= 1.0.5 - Missing Authorization
5.3
CVE-2023-52199
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Google Analytics by Monster Insights <= 8.21.0 - Missing Authorization
4.3
CVE-2023-52220
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N
WooCommerce <= 8.2.2 - Cross-Site Request Forgery
4.3
CVE-2023-52222
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WP Job Manager <= 2.0.0 - Cross-Site Request Forgery
4.3
CVE-2023-52212
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
WP Job Manager <= 2.0.0 - Missing Authorization
5.3
CVE-2023-52211
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Gecka Terms Thumbnails <= 1.1 - Authenticated (Subscriber+) PHP Object Injection
8.8
CVE-2023-52219
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Taggbox <= 3.1 - Unauthenticated PHP Object Injection
9.8
CVE-2023-52225
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
WooCommerce Tranzila Gateway <= 1.0.8 - Unauthenticated PHP Object Injection
9.8
CVE-2023-52218
Jan 5, 2024
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
Automatic <= 3.92.0 - Unauthenticated SQL Injection CVE-2024-27956 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H March 13, 2024
Automatic <= 3.92.0 - Cross-Site Request Forgery to Privilege Escalation CVE-2024-27955 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H March 13, 2024
Automatic <= 3.92.0 - Unauthenticated Arbitrary File Download and Server-Side Request Forgery CVE-2024-27954 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H March 13, 2024
LiteSpeed Cache <= 5.7 - Unauthenticated Stored Cross-Site Scripting via 'nameservers' and '_msg' CVE-2023-40000 7.2 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N February 27, 2024
Brooklyn <= 4.9.7.6 - Reflected Cross-Site Scripting CVE-2024-24927 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N February 9, 2024
Brooklyn <= 4.9.7.6 - PHP Object Injection CVE-2024-24926 7.5 CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H February 9, 2024
WooCommerce Box Office <= 1.2.2 - Missing Authorization CVE-2024-24799 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 31, 2024
WooCommerce Subscriptions < 5.8.0 - Missing Authorization CVE-2023-50850 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 17, 2024
ARMember <= 4.0.22 - Cross-Site Request Forgery CVE-2023-52200 6.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L January 11, 2024
AI Engine: ChatGPT Chatbot <= 1.9.98 - Unauthenticated Arbitrary File Upload via rest_upload CVE-2023-51409 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 9, 2024
Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated Arbitrary File Upload via uploadFile CVE-2023-52221 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 8, 2024
Barcode Scanner with Inventory & Order Manager <= 1.5.1 - Unauthenticated SQL Injection via userToken CVE-2023-52215 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 8, 2024
ActivityPub <= 1.0.5 - Missing Authorization CVE-2023-52199 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N January 5, 2024
Google Analytics by Monster Insights <= 8.21.0 - Missing Authorization CVE-2023-52220 4.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N January 5, 2024
WooCommerce <= 8.2.2 - Cross-Site Request Forgery CVE-2023-52222 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 5, 2024
WP Job Manager <= 2.0.0 - Cross-Site Request Forgery CVE-2023-52212 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N January 5, 2024
WP Job Manager <= 2.0.0 - Missing Authorization CVE-2023-52211 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N January 5, 2024
Gecka Terms Thumbnails <= 1.1 - Authenticated (Subscriber+) PHP Object Injection CVE-2023-52219 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 5, 2024
Taggbox <= 3.1 - Unauthenticated PHP Object Injection CVE-2023-52225 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 5, 2024
WooCommerce Tranzila Gateway <= 1.0.8 - Unauthenticated PHP Object Injection CVE-2023-52218 9.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H January 5, 2024

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation