TomS (Rand0mGen)

TomS (Rand0mGen) is a security researcher credited with 10 disclosed vulnerabilities in the WordSec WordPress vulnerability database, ranked #416 of 3,333 contributors. Their disclosures were published between 2022 and 2023. The most productive year was 2022, with 6 findings.

Their research concentrates on SQL Injection, which accounts for 3 of their findings (30%). Other recurring categories include Code Injection, Path Traversal. The average CVSS score across these disclosures is 7.0, peaking at 9.8. Severity breakdown: 1 critical and 6 high.

The most affected software includes Easy WP SMTP (3), Kanban Boards for WordPress (2), Advanced Page Visit Counter (1), across 7 distinct plugins, themes and core versions in total.

9 of the 10 disclosed issues have a vendor fix, while 1 remain unpatched. The most severe finding, "Cryptocurrency Widgets Pack <= 1.8.1 - Unauthenticated SQL Injection", scores 9.8 out of 10.

20222023

Critical

High

Medium

Low

Global Rank

#416

of 3,333 researchers

Vulns

Critical1

High6

Medium2

Low1

Affected Assets

7plugins

Avg CVSS

7.0

Average score of vulnerabilities

Researcher Submissions

10 records


2023-10-03 00:00	Advanced Page Visit Counter <= 7.1.1 - Authenticated (Contributor+) SQL Injection Advanced Page Visit Counter <= 7.1.1	`CVE-2023-45074`	8.8 High	TomS (Rand0mGen)	Yes
2023-08-17 00:00	Kanban Boards <= 2.5.21 - Authenticated (Administrator+) Remote Code Execution Kanban Boards for WordPress <= 2.5.21	`CVE-2023-40606`	7.2 High	TomS (Rand0mGen)	No
2023-06-02 00:00	Kanban Boards for WordPress <= 2.5.20 - Authenticated (Administrator+) Stored Cross-Site Scripting Kanban Boards for WordPress <= 2.5.20	`CVE-2023-34368`	4.4 Medium	TomS (Rand0mGen)	Yes
2023-04-24 00:00	BSK Forms Blacklist <= 3.6.2 - Authenticated (Administrator+) SQL Injection via 'order' and 'orderby' BSK Forms Blacklist <= 3.6.2	`CVE-2023-30872`	7.2 High	TomS (Rand0mGen)	Yes
2022-12-13 00:00	Cryptocurrency Widgets Pack <= 1.8.1 - Unauthenticated SQL Injection Cryptocurrency Widgets Pack <= 1.8.1	`CVE-2022-44588`	9.8 Critical	TomS (Rand0mGen)	Yes
2022-11-30 00:00	WP Tools <= 3.41 - Missing Authorization leading to Authenticated (Subscriber+) Authorization Bypass WP Tools Debug Log <= 3.41	`CVE-2022-43453`	8.8 High	TomS (Rand0mGen)	Yes
2022-11-30 00:00	Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Arbitrary File Deletion Easy WP SMTP <= 1.5.1	`CVE-2022-45829`	6.5 Medium	TomS (Rand0mGen)	Yes
2022-11-30 00:00	Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Remote Code Execution Easy WP SMTP <= 1.5.1	`CVE-2022-42699`	7.2 High	TomS (Rand0mGen)	Yes
2022-11-30 00:00	Easy WP SMTP <= 1.5.1 - Authenticated (Admin+) Directory Traversal Easy WP SMTP <= 1.5.1	`CVE-2022-45833`	2.7 Low	TomS (Rand0mGen)	Yes
2022-11-10 00:00	S2W – Import Shopify to WooCommerce <= 1.1.12 - Authenticated (Admin+) Local File Inclusion S2W <= 1.1.12	`CVE-2022-44634`	7.2 High	TomS (Rand0mGen)	Yes

Showing 1–10 of 10 reports