Solwininfotech User Activity Log — known CVE vulnerabilities

Every CVE whose affected-product data names Solwininfotech User Activity Log, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (7)

• CVE-2023-3435 — CVSS 9.8 (critical): The User Activity Log WordPress plugin before 1.6.5 does not correctly sanitise and escape several parameters before using it in a SQL…
• CVE-2023-37966 — CVSS 7.6 (high): Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Solwin Infotech User Activity Log…
• CVE-2023-4279 — CVSS 7.5 (high): This User Activity Log WordPress plugin before 1.6.7 retrieves client IP addresses from potentially untrusted headers, allowing an attacker…
• CVE-2023-5133 — CVSS 7.5 (high): This user-activity-log-pro WordPress plugin before 2.3.4 retrieves client IP addresses from potentially untrusted headers, allowing an…
• CVE-2023-2761 — CVSS 7.2 (high): The User Activity Log WordPress plugin before 1.6.3 does not properly sanitise and escape the `txtsearch` parameter before using it in a…
• CVE-2023-5167 — CVSS 5.4 (medium): The User Activity Log Pro WordPress plugin before 2.3.4 does not properly escape recorded User-Agents in the user activity logs dashboard…
• CVE-2023-4269 — CVSS 4.3 (medium): The User Activity Log WordPress plugin before 1.6.6 lacks proper authorisation when exporting its activity logs, allowing any authenticated…