GiongfNef

GiongfNef is a security researcher credited with 10 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #465 of 3,515 contributors. Their disclosures were published between 2023 and 2024. The most productive year was 2024, with 9 findings.

Their research concentrates on Cross-Site Request Forgery (CSRF), which accounts for 5 of their findings (50%). Other recurring categories include Missing Authorization. The average CVSS score across these disclosures is 5.0, peaking at 8.8. Severity breakdown: 0 critical and 1 high.

The most affected software includes LadiApp (8), Microsoft Clarity (1), WP EXtra (1), across 3 distinct plugins, themes and core versions in total.

2 of the 10 disclosed issues have a vendor fix, while 8 remain unpatched. The most severe finding, "WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modification", scores 8.8 out of 10.

20232024

Critical

High

Medium

Low

Global Rank

#465

of 3,515 researchers

Vulns

Critical0

High1

Medium9

Low0

Affected Assets

3plugins

Avg CVSS

5.0

Average score of vulnerabilities

Researcher Submissions

10 records


2024-08-16 00:00	LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.3 - Missing Authorization via init_endpoint LadiApp <= 4.3	`CVE-2023-4730`	5.3 Medium	GiongfNef	No
2024-03-11 00:00	LadiApp <= 4.4 - Cross-Site Request Forgery via ladiflow_save_hook() LadiApp <= 4.4	`CVE-2023-4628`	4.3 Medium	GiongfNef	No
2024-03-11 00:00	LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.4 - Cross-Site Request Forgery via init_endpoint LadiApp <= 4.4	`CVE-2023-4731`	4.3 Medium	GiongfNef	No
2024-03-11 00:00	LadiApp <= 4.4 - Missing Authorization via ladiflow_save_hook() LadiApp 4.3	`CVE-2023-4626`	4.3 Medium	GiongfNef	No
2024-03-11 00:00	LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.4 - Missing Authorization on publish_lp() LadiApp <= 4.4	`CVE-2023-4728`	4.3 Medium	GiongfNef	No
2024-03-11 00:00	LadiApp <= 4.4 - Missing Authorization via save_config() LadiApp <= 4.4	`CVE-2023-4627`	4.3 Medium	GiongfNef	No
2024-03-11 00:00	LadiApp: Landing Page, PopupX, Marketing Automation, Affiliate Marketing… <= 4.4 - Cross-Site Request Forgery via publish_lp() LadiApp <= 4.4	`CVE-2023-4729`	4.3 Medium	GiongfNef	No
2024-03-11 00:00	LadiApp <= 4.4 - Cross-Site Request Forgery via save_config() LadiApp <= 4.3	`CVE-2023-4629`	4.3 Medium	GiongfNef	No
2024-02-16 00:00	Microsoft Clarity <= 0.9.3 - Cross-Site Request Forgery to Stored Cross-Site Scripting Microsoft Clarity <= 0.9.3	`CVE-2024-0590`	6.1 Medium	GiongfNef	Yes
2023-10-24 00:00	WP EXtra <= 6.2 - Missing Authorization to .htaccess File Modification WP EXtra <= 6.2	`CVE-2023-5311`	8.8 High	GiongfNef	Yes

Showing 1–10 of 10 reports