PT-2013-5720

Name of the Vulnerable Software and Affected Versions IndiaNIC Testimonial plugin version 2.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the custom query parameter in a testimonial add action to the "wp-admin/admin-ajax.php"...

CVE-2013-4600: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Alkacon OpenCms before 8.5.2 allow remote attackers to inject arbitrary web script or HTML via the 1 title parameter to system/workplace/views/admin/admin-main.jsp or the 2 requestedResource parameter to system/login/index.html...

PT-2013-5292

Name of the Vulnerable Software and Affected Versions BuddyPress Extended Friendship Request plugin versions prior to 1.0.2 Description The issue allows remote attackers to inject arbitrary web script or HTML via the friendship request message parameter to the "wp-admin/admin-ajax.php" API endpoi...

XSS vulnerability in invite-users-panel.vm [$i18n.getText('easyuser.send.invitations.email.placeholder', [$siteTitle]), line 37]

Panopticon http://panopticon.dyn.syd.atlassian.com/ has detected that the following file contains a XSS vulnerability. This vulnerability has been manually confirmed. File: confluence-plugins/confluence-bundled-plugins/confluence-easyuser-admin/src/main/resources/templates/invite-users-panel.vm...

PT-2012-5723

Name of the Vulnerable Software and Affected Versions VR GPub version 4.0 Description A cross-site request forgery CSRF issue exists, allowing remote attackers to hijack the authentication of admins for requests that add admin accounts via an add action in the admin/admin options.php file...

PT-2012-4378

Name of the Vulnerable Software and Affected Versions Pligg CMS versions prior to 1.2.2 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved through several parameters in different actions and files, including the "list" parameter in a move action ...

CVE-2012-1936: Cross-Site Request Forgery (CSRF)

The wpcreatenonce function in wp-includes/pluggable.php in WordPress 3.3.1 and earlier associates a nonce with a user account instead of a user session, which might make it easier for remote attackers to conduct cross-site request forgery CSRF attacks on specific actions and objects by sniffing t...

CVE-2009-4458: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in FreePBX 2.5.2 and 2.6.0rc2, and possibly other versions, allow remote attackers to inject arbitrary web script or HTML via the 1 tech parameter to admin/admin/config.php during a trunks display action, the 2 description parameter during an Add...

CVE-2007-4893: Cross-Site Request Forgery (CSRF)

wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user MU before 1.2.5a does not properly verify the unfilteredhtml privilege, which allows remote attackers to conduct cross-site scripting XSS attacks via modified data to 1 post.php or 2 page.php with a nofilter field...

CVE-2007-2821

SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter...

CVE-2007-2821

SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter...

CVE-2007-2821: Undefined Security Weakness

SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter...

CVE-2007-1409: Undefined Security Weakness

WordPress allows remote attackers to obtain sensitive information via a direct request for wp-admin/admin-functions.php, which reveals the path in an error message...

CVE-2006-6808: Undefined Security Weakness

Cross-site scripting XSS vulnerability in wp-admin/templates.php in WordPress 2.0.5 allows remote attackers to inject arbitrary web script or HTML via the file parameter. NOTE: some sources have reported this as a vulnerability in the getfiledescription function in wp-admin/admin-functions.php...