Persistent Login
Monthly
SQL injection in the Persistent Login WordPress plugin (versions ≤ 3.1.0) allows network-accessible, subscriber-level authenticated attackers to extract sensitive database contents by injecting arbitrary SQL via the wppl_device_id cookie. The flaw - CWE-89 caused by missing input escaping and absent query parameterization in the Login History feature - carries a CVSS 6.5 with high confidentiality impact and no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.0.0 before 1.8.0, from 2.0.* before 2.2.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
SQL injection in the Persistent Login WordPress plugin (versions ≤ 3.1.0) allows network-accessible, subscriber-level authenticated attackers to extract sensitive database contents by injecting arbitrary SQL via the wppl_device_id cookie. The flaw - CWE-89 caused by missing input escaping and absent query parameterization in the Login History feature - carries a CVSS 6.5 with high confidentiality impact and no integrity or availability impact. No public exploit code or CISA KEV listing has been identified at time of analysis.
Insufficient Session Expiration vulnerability in Drupal Persistent Login allows Forceful Browsing.0.0 before 1.8.0, from 2.0.* before 2.2.2. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.