bl4derunner

bl4derunner is a security researcher credited with 14 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #338 of 3,515 contributors. Their disclosures were published between 2021 and 2022. The most productive year was 2021, with 13 findings.

Their research concentrates on SQL Injection, which accounts for 11 of their findings (79%). Other recurring categories include Code Injection. The average CVSS score across these disclosures is 7.5, peaking at 8.8. Severity breakdown: 0 critical and 14 high.

The most affected software includes Check & Log Email (1), Download Monitor (1), Email Before Download (1), across 14 distinct plugins, themes and core versions in total.

13 of the 14 disclosed issues have a vendor fix, while 1 remain unpatched. The most severe finding, "Rich Reviews by Starfish <= 1.9.5 - SQL Injection", scores 8.8 out of 10.

20212022

Critical

High

Medium

Low

Global Rank

#338

of 3,515 researchers

Vulns

Critical0

High14

Medium0

Low0

Affected Assets

14plugins

Avg CVSS

7.5

Average score of vulnerabilities

Researcher Submissions

14 records


2022-11-29 00:00	Menu Item Visibility Control <= 0.5 - Authenticated (Admin+) Remote Code Execution Menu Item Visibility Control <= 0.5	`CVE-2021-24942`	7.2 High	bl4derunner	No
2021-11-29 00:00	Rich Reviews by Starfish <= 1.9.5 - SQL Injection Rich Reviews by Starfish < 1.9.6	`CVE-2021-24753`	8.8 High	bl4derunner	Yes
2021-11-15 00:00	SEO Booster <= 3.7 - Admin+ SQL Injection SEO Booster <= 3.7	`CVE-2021-24747`	7.2 High	bl4derunner	Yes
2021-11-01 00:00	myCred – Points, Rewards, Gamification, Ranks, Badges & Loyalty Plugin <= 2.2 - Subscriber+ SQL Injection Points Management System… <= 2.2	`CVE-2021-24755`	8.8 High	bl4derunner	Yes
2021-11-01 00:00	Email Before Download <= 6.7 - Admin+ SQL Injection Email Before Download <= 6.7	`CVE-2021-24748`	7.2 High	bl4derunner	Yes
2021-10-20 00:00	Download Monitor <= 4.4.4 - Admin+ SQL Injection via orderby parameter Download Monitor < 4.4.5	`CVE-2021-24786`	7.2 High	bl4derunner	Yes
2021-10-18 00:00	Stream <= 3.8.1 - Admin+ SQL Injection Stream <= 3.8.1	`CVE-2021-24772`	7.2 High	bl4derunner	Yes
2021-10-18 00:00	Email Log <= 2.4.6 - Admin+ SQL Injection Email Log <= 2.4.6	`CVE-2021-24758`	7.2 High	bl4derunner	Yes
2021-10-11 00:00	Header Footer Code Manager <= 1.1.13 - Authenticated SQL Injections Header Footer Code Manager < 1.1.14	`CVE-2021-24791`	7.2 High	bl4derunner	Yes
2021-10-11 00:00	Similar Posts <= 3.1.5 - Admin+ Arbitrary PHP Code Execution Similar Posts <= 3.1.5	`CVE-2021-24537`	7.2 High	bl4derunner	Yes

Showing 1–10 of 14 reports