Gibran Abdillah

WCFM Marketplace <= 3.7.0 - Insecure Direct Object Reference to Unauthenticated Arbitrary Refund Request Creation

Materialis <= 1.1.24 - Missing Authorization to Limited Arbitrary Options Update

KiviCare – Clinic & Patient Management System (EHR) <= 4.1.2 - Unauthenticated Authentication Bypass via Social Login Token

NewsBlogger <= 0.2.5.4 - Cross-Site Request Forgery to Arbitrary Plugin Installation

Salon Booking System <= 10.2 - Unauthenticated Arbitrary File Upload

Newscrunch <= 1.8.4 - Cross-Site Request Forgery to Arbitrary File Upload

App Builder – Create Native Android & iOS Apps On The Flight <= 5.5.10 - Unauthenticated Privilege Escalation via 'role' Parameter

Ovic Responsive WPBakery < 1.2.9 - Subscriber+ Option Update

Appointment Booking Calendar Plugin and Online Scheduling Plugin – BookingPress 1.1.6 - 1.1.7 - Authentication Bypass to Account Takeover

Jquery Validation For Contact Form 7 < 5.3 - Arbitrary Options Update via CSRF