Tobias Weißhaar (kun_19)

Tobias Weißhaar (kun_19) is a security researcher credited with 14 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #342 of 3,515 contributors. The disclosure was published in 2024.

Their research concentrates on Cross-Site Scripting, which accounts for 5 of their findings (36%). Other recurring categories include Missing Authorization, Code Injection. The average CVSS score across these disclosures is 6.9, peaking at 9.9. Severity breakdown: 2 critical and 3 high.

The most affected software includes Fluent Forms (6), File Manager Pro (2), Photo Gallery by 10Web (2), across 7 distinct plugins, themes and core versions in total.

All 14 disclosed issues have since received a vendor fix. The most severe finding, "File Manager And File Manager Pro (Multiple Versions) - Directory Traversal", scores 9.9 out of 10.

2024

Critical

High

Medium

Low

Global Rank

#342

of 3,515 researchers

Vulns

Critical2

High3

Medium9

Low0

Affected Assets

7plugins

Avg CVSS

6.8

Average score of vulnerabilities

Researcher Submissions

14 records


2024-08-31 21:37	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.18 - Missing Authorization to Authenticated (Subscriber+) Mailchimp Integration Modification Fluent Forms <= 5.1.18	`CVE-2024-5053`	4.2 Medium	Tobias Weißhaar (kun_19)	Yes
2024-06-06 21:19	Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Path Traversal via esc_dir Function Photo Gallery by 10Web <= 1.8.23	`CVE-2024-5481`	6.8 Medium	Tobias Weißhaar (kun_19)	Yes
2024-06-06 21:15	Photo Gallery by 10Web – Mobile-Friendly Image Gallery <= 1.8.23 - Authenticated (Contributor+) Stored Cross-Site Scripting via Zipped SVG Photo Gallery by 10Web <= 1.8.23	`CVE-2024-5426`	6.4 Medium	Tobias Weißhaar (kun_19)	Yes
2024-06-06 00:00	TablePress – Tables in WordPress made easy <= 2.3 - Authenticated (Author+) Server-Side Request Forgery via DNS Rebind TablePress <= 2.3.1	`CVE-2024-4354`	6.4 Medium	Tobias Weißhaar (kun_19)	Yes
2024-05-21 00:00	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.15 - PHP Object Injection via extractDynamicValues Fluent Forms <= 5.1.15	`CVE-2024-4157`	7.5 High	Tobias Weißhaar (kun_19)	Yes
2024-05-17 19:02	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.13 - Authenticated (Subscriber+) Stored Cross-Site Scripting Fluent Forms <= 5.1.13	`CVE-2024-2772`	6.4 Medium	Tobias Weißhaar (kun_19)	Yes
2024-05-17 19:02	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Setting Manipulation Fluent Forms <= 5.1.16	`CVE-2024-2782`	7.5 High	Tobias Weißhaar (kun_19)	Yes
2024-05-17 19:02	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Missing Authorization to Settings Update and Limited Privilege Escalation Fluent Forms <= 5.1.16	`CVE-2024-2771`	9.8 Critical	Tobias Weißhaar (kun_19)	Yes
2024-05-17 00:00	Contact Form Plugin by Fluent Forms for Quiz, Survey, and Drag & Drop WP Form Builder <= 5.1.16 - Authenticated (Contributor+) Stored Cross-Site Scripting Fluent Forms <= 5.1.16	`CVE-2024-4709`	6.4 Medium	Tobias Weißhaar (kun_19)	Yes
2024-03-28 00:00	Ninja Forms Contact Form – The Drag and Drop Form Builder for WordPress <= 3.8.0 - Cross-Site Request Forgery to Publicly Accessible Form Submission Export Ninja Forms <= 3.8.0	`CVE-2024-2113`	4.3 Medium	Tobias Weißhaar (kun_19)	Yes

Showing 1–10 of 14 reports