CVE-2021-38359: Improper Neutralization of Input During Web Page Generation

The WordPress InviteBox Plugin for viral Refer-a-Friend Promotions WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the message parameter found in the /admin/admin.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.4.1...

CVE-2020-18264

Cross Site Request Forgery CSRF in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=acteditmember"...

PT-2021-10165

Name of the Vulnerable Software and Affected Versions: Simple-Log version 1.6 Description: The issue allows remote attackers to gain privilege and execute arbitrary code. This is achieved via the "Simple-Log/admin/admin.php?act=act edit member" API endpoint. Recommendations: For Simple-Log versio...

CVE-2020-18265: Cross-Site Request Forgery (CSRF)

Cross Site Request Forgery CSRF in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=actaddmember"...

PT-2021-3318

Name of the Vulnerable Software and Affected Versions DSGVO All in one for WP versions prior to 4.0 Description The issue is related to the failure to neutralize special elements, which can lead to cross-site scripting XSS attacks. An unauthenticated attacker can exploit this by submitting...

CVE-2021-24177: Improper Neutralization of Input During Web Page Generation

In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...

PT-2021-15723

Name of the Vulnerable Software and Affected Versions: File Manager WordPress plugin versions prior to 7.1 Description: A Reflected XSS issue can occur in the default configuration of the plugin when a payload is submitted on the User-Agent parameter. This payload is then reflected back on the we...

PT-2020-17138

Name of the Vulnerable Software and Affected Versions SabaiApp Directories Pro plugin version 1.3.45 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via a POST to "/wp-admin/admin.php?page=drts/directories&q=%2F" with the drts form build...

CVE-2020-10984

Gambio GX (before 4.0.1.0) contains a CSRF vulnerability in admin/admin.php. The CVE entry CVE-2020-10984 documents a cross-site request forgery flaw affecting the admin interface; no explicit remediation is provided in the connected sources. The public references confirm the affected product/ver...

CVE-2020-10984: Cross-Site Request Forgery (CSRF)

Gambio GX before 4.0.1.0 allows admin/admin.php CSRF...

PT-2020-12469

Name of the Vulnerable Software and Affected Versions Gambio GX versions prior to 4.0.1.0 Description The issue allows for a CSRF attack on the admin/admin.php endpoint. This can be exploited by tricking an administrator into performing unintended actions on the Gambio GX platform. Recommendation...

PT-2020-10051

Name of the Vulnerable Software and Affected Versions wpForo plugin version 1.6.5 Description The issue concerns a CSRF vulnerability in the wpForo plugin for WordPress. It affects the "wp-admin/admin.php?page=wpforo-usergroups" endpoint. There is no information provided about the estimated numbe...

PT-2020-10053

Name of the Vulnerable Software and Affected Versions wpForo plugin version 1.6.5 Description The issue allows for XSS via the "wp-admin/admin.php?page=wpforo-phrases" API endpoint, specifically through the langid parameter. Recommendations For wpForo plugin version 1.6.5, avoid using the langid...

CVE-2019-19109: Cross-Site Request Forgery (CSRF)

The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...

CVE-2019-19111: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...

CVE-2019-19110: Improper Neutralization of Input During Web Page Generation

The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...

PT-2020-20618

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar plugin versions prior to 1.3.35 Description The issue allows user input in fields such as Description or Name in any booking form to be any formula. This input could then be exported via the Bookings list tab in...

PT-2020-7816

Name of the Vulnerable Software and Affected Versions: Huge-IT Slider slider-image plugin versions prior to 2.7.0 Description: The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the removeslide parameter in a popup posts or edit cat action in the...

CVE-2015-2062: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Huge-IT Slider slider-image plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popupposts or editcat action in the slidershugeitslider page to wp-admin/admin.php...

CVE-2020-8658: Cross-Site Request Forgery (CSRF)

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...