Veille CVE

Recherche « AppMySite »

2 CVE

Critique 0 Élevée 0 Moyenne 2 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « AppMySite » ✕
  1. CVE-2026-94498 6.5 Moyenne

    AppMySite

    Unauthenticated Broken Access Control in AppMySite <= 3.15.4 versions.

  2. CVE-2026-13770 6.4 Moyenne

    AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker)

    The AppMySite – WordPress & WooCommerce Mobile App Builder (No-Code Android & iOS App Maker) plugin for WordPress is vulnerable to Stored Cross-Site Scripting via save_ams_license_key AJAX Handler in all versions up to, and including, 3.15.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers, with Subscriber-level access and above, to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. The save_ams_license_key AJAX handler performs no capability check and no nonce verification, meaning any authenticated user with Subscriber-level access or above can invoke it to store the malicious payload.