Wordfence Intelligence   >   Vulnerability Researchers   >   Vladislav Pokrovsky (ΞX.MI)

Vladislav Pokrovsky (ΞX.MI)

Organization: Independent AppSec Researcher

6
All Time Ranking
260
All Time Discoveries

About

AppSec // Bug Bounty // Legal Hacking

«When you lose fun and start doing things only for the payback, you're dead.» © Phrack #65

Showing 101-120 of 260 Vulnerabilities

Psychological tests & quizzes <= 0.21.19 - Authenticated (Contributor+) Cross-Site Scripting
5.4
CVE-2022-27854
Apr 26, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N
Night Mode <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting
5.5
CVE-2022-29418
Apr 25, 2022
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N
Advanced Contact form 7 DB <= 1.8.7 - Stored Cross-Site Scripting
6.1
CVE-2022-29408
Apr 21, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Rara One Click Demo Import <= 1.2.9 - Cross-Site Request Forgery to Arbitrary File Upload
8.8
CVE-2022-29451
Apr 21, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Simple Ajax Chat <= 20220115 - Cross-Site Request Forgery
5.4
CVE-2022-27850
Apr 15, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Simple Ajax Chat Plugin <= 20220115 - Sensitive Information Disclosure
5.3
CVE-2022-27849
Apr 15, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
eRoom – Zoom Meetings & Webinar <= 1.3.8 - Cross-Site Request Forgery
4.3
CVE-2022-25615
Apr 11, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
eRoom – Zoom Meetings & Webinar <= 1.3.7 - Cross-Site Request Forgery
4.3
CVE-2022-25614
Apr 11, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery
4.3
CVE-2022-27846
Apr 11, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
FV Flowplayer Video Player <= 7.5.18.727 - Stored Cross-Site Scripting
6.4
CVE-2022-25613
Apr 4, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N
Simple Event Planner plugin <= 1.5.4 - Cross-Site Scripting
4.1
CVE-2022-25612
Mar 23, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N
Contact Form X <= 2.4 - Reflected Cross-Site Scripting
6.1
CVE-2022-25601
Feb 25, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery
5.4
CVE-2022-25600
Feb 22, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
Spiffy Calendar <= 4.9.0 - Edit/Delete event via IDOR
6.3
CVE-2022-29434
Feb 10, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L
[GWA] AutoResponder <= 2.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting
8.8
CVE ID Unknown
Jan 27, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Access Demo Importer <= 1.0.7 - Cross-Site Request Forgery to Data Reset
8.1
CVE-2022-23976
Jan 24, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H
Better Messages <= 1.9.9.148 - Cross-Site Request Forgery
8.8
CVE-2022-36389
Jan 18, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
WP-DownloadManager plugin <= 1.68.6 - Stored Cross-Site Scripting
4.8
CVE-2022-25605
Jan 12, 2022
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N
AccessPress Themes and Plugin <= Various Versions - Cross-Site Request Forgery
8.8
CVE ID Unknown
Jan 11, 2022
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
AccessPress Themes and Plugin <= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation
8.8
CVE-2022-23975
Jan 11, 2022
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Title CVE ID CVSS Vector Date
Psychological tests & quizzes <= 0.21.19 - Authenticated (Contributor+) Cross-Site Scripting CVE-2022-27854 5.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N April 26, 2022
Night Mode <= 1.0.0 - Authenticated (Admin+) Stored Cross-Site Scripting CVE-2022-29418 5.5 CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:L/A:N April 25, 2022
Advanced Contact form 7 DB <= 1.8.7 - Stored Cross-Site Scripting CVE-2022-29408 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N April 21, 2022
Rara One Click Demo Import <= 1.2.9 - Cross-Site Request Forgery to Arbitrary File Upload CVE-2022-29451 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H April 21, 2022
Simple Ajax Chat <= 20220115 - Cross-Site Request Forgery CVE-2022-27850 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L April 15, 2022
Simple Ajax Chat Plugin <= 20220115 - Sensitive Information Disclosure CVE-2022-27849 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N April 15, 2022
eRoom – Zoom Meetings & Webinar <= 1.3.8 - Cross-Site Request Forgery CVE-2022-25615 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N April 11, 2022
eRoom – Zoom Meetings & Webinar <= 1.3.7 - Cross-Site Request Forgery CVE-2022-25614 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N April 11, 2022
Yoo Slider plugin <= 2.0.0 - Cross-Site Request Forgery CVE-2022-27846 4.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N April 11, 2022
FV Flowplayer Video Player <= 7.5.18.727 - Stored Cross-Site Scripting CVE-2022-25613 6.4 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:L/I:L/A:N April 4, 2022
Simple Event Planner plugin <= 1.5.4 - Cross-Site Scripting CVE-2022-25612 4.1 CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N March 23, 2022
Contact Form X <= 2.4 - Reflected Cross-Site Scripting CVE-2022-25601 6.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N February 25, 2022
WP MAPS – Easiest & Most Advanced WordPress Plugin for Google Maps <= 4.2.3 - Cross-Site Request Forgery CVE-2022-25600 5.4 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L February 22, 2022
Spiffy Calendar <= 4.9.0 - Edit/Delete event via IDOR CVE-2022-29434 6.3 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:L February 10, 2022
[GWA] AutoResponder <= 2.7.4 - Cross-Site Request Forgery to Stored Cross-Site Scripting 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H January 27, 2022
Access Demo Importer <= 1.0.7 - Cross-Site Request Forgery to Data Reset CVE-2022-23976 8.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:H January 24, 2022
Better Messages <= 1.9.9.148 - Cross-Site Request Forgery CVE-2022-36389 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H January 18, 2022
WP-DownloadManager plugin <= 1.68.6 - Stored Cross-Site Scripting CVE-2022-25605 4.8 CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N January 12, 2022
AccessPress Themes and Plugin <= Various Versions - Cross-Site Request Forgery 8.8 CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H January 11, 2022
AccessPress Themes and Plugin <= Various Versions - Missing Authorization to Arbitrary Plugin Deactivation/Activation CVE-2022-23975 8.8 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H January 11, 2022

Share this researcher's vulnerability discoveries

Did you know Wordfence Intelligence provides free personal and commercial API access to our comprehensive WordPress vulnerability database, along with a free webhook integration to stay on top of the latest vulnerabilities added and updated in the database? Get started today!

Learn more

Want to get notified of the latest vulnerabilities that may affect your WordPress site?
Install Wordfence on your site today to get notified immediately if your site is affected by a vulnerability that has been added to our database.

Get Wordfence

The Wordfence Intelligence WordPress vulnerability database is completely free to access and query via API. Please review the documentation on how to access and consume the vulnerability data via API.

Documentation