SupportCandy records

9 published records for vendor supportcandy.

Researcher profile

Entered KEV: 0 · 0%
Weaponized: 0 · 0%
Pre-auth RCE: 1
With a fix record: 0%
Median publish → KEV: No record has entered KEV

Records by year

Bar: total · dark part: CISA KEV.

Recurring classes

The weakness classes this vendor ships most often: where to look.

Attack profile

All records

9 records

CVE records
Action	CVE	Vulnerability	Severity	KEV	EPSS	Published
51Plan	CVE-2023-1730Proof of concept	SupportCandy < 3.1.5 - Unauthenticated SQLisupportcandy · supportcandy · CWE-89 Pre-auth SQL injection	Critical9.8	—	40.6%	May 2, 2023
42Plan	CVE-2019-11223Proof of concept	An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrarsupportcandy · supportcandy · CWE-434 pre-auth RCE File upload	Critical9.8	—	8.8%	Apr 18, 2019
35Monitor	CVE-2023-2719No exploit	SupportCandy < 3.1.7 - Subscriber+ SQLisupportcandy · supportcandy · CWE-89 SQL injection	High8.8	—	1.2%	Jun 19, 2023
35Monitor	CVE-2021-24879No exploit	SupportCandy < 2.2.7 - CSRF to Cross-Site Scriptingsupportcandy · supportcandy · CWE-352 Pre-auth XSS CSRF	High8.8	—	0.6%	Feb 7, 2022
30Monitor	CVE-2021-24839No exploit	SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletionsupportcandy · supportcandy · CWE-862 Pre-auth Broken access control (IDOR) CSRF	High7.5	—	1.2%	Feb 7, 2022
28Monitor	CVE-2023-2805No exploit	SupportCandy < 3.1.7 - Admin+ SQLisupportcandy · supportcandy · CWE-89 SQL injection	High7.2	—	0.9%	Jun 19, 2023
26Monitor	CVE-2021-24843No exploit	SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRFsupportcandy · supportcandy · CWE-352 Pre-auth CSRF	Medium6.5	—	0.5%	Feb 7, 2022
24Monitor	CVE-2021-24878Proof of concept	SupportCandy < 2.2.7 - Reflected Cross-Site Scriptingsupportcandy · supportcandy · CWE-79 Pre-auth XSS	Medium6.1	—	1.2%	Feb 7, 2022
21Monitor	CVE-2021-24880No exploit	SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site Scriptingsupportcandy · supportcandy · CWE-79 XSS	Medium5.4	—	0.6%	Feb 7, 2022

CVE-2023-1730
51Plan
SupportCandy < 3.1.5 - Unauthenticated SQLi
CriticalCVSS 9.8Proof of conceptEPSS 41%
- Pre-auth
- SQL injection
supportcandy · supportcandyMay 2, 2023
CVE-2019-11223
42Plan
An Unrestricted File Upload Vulnerability in the SupportCandy plugin through 2.0.0 for WordPress allows remote attackers to execute arbitrar
CriticalCVSS 9.8Proof of conceptEPSS 9%
- pre-auth RCE
- File upload
supportcandy · supportcandyApr 18, 2019
CVE-2023-2719
35Monitor
SupportCandy < 3.1.7 - Subscriber+ SQLi
HighCVSS 8.8No exploitEPSS 1%
- SQL injection
supportcandy · supportcandyJun 19, 2023
CVE-2021-24879
35Monitor
SupportCandy < 2.2.7 - CSRF to Cross-Site Scripting
HighCVSS 8.8No exploitEPSS 1%
supportcandy · supportcandyFeb 7, 2022
CVE-2021-24839
30Monitor
SupportCandy < 2.2.5 - Unauthenticated Arbitrary Ticket Deletion
HighCVSS 7.5No exploitEPSS 1%
supportcandy · supportcandyFeb 7, 2022
CVE-2023-2805
28Monitor
SupportCandy < 3.1.7 - Admin+ SQLi
HighCVSS 7.2No exploitEPSS 1%
- SQL injection
supportcandy · supportcandyJun 19, 2023
CVE-2021-24843
26Monitor
SupportCandy < 2.2.7 - Arbitrary Ticket Deletion via CSRF
MediumCVSS 6.5No exploitEPSS 1%
- Pre-auth
- CSRF
supportcandy · supportcandyFeb 7, 2022
CVE-2021-24878
24Monitor
SupportCandy < 2.2.7 - Reflected Cross-Site Scripting
MediumCVSS 6.1Proof of conceptEPSS 1%
- Pre-auth
- XSS
supportcandy · supportcandyFeb 7, 2022
CVE-2021-24880
21Monitor
SupportCandy < 2.2.7 - Contributor+ Stored Cross-Site Scripting
MediumCVSS 5.4No exploitEPSS 1%
- XSS
supportcandy · supportcandyFeb 7, 2022