tomatesverdes.cl XSS vulnerability

Vulnerable URL: http://tomatesverdes.cl/wp-admin/admin-ajax.php?action=revsliderajaxactionaction= derp Details: Description| Value ---|--- Patched:| Yes, at 26.09.2015 Latest check for patch:| 26.09.2015 01:35 GMT Vulnerability type:| XSS Vulnerability status:| Publicly disclosed Alexa Rank|...

WordPress Unite Gallery Lite Plugin 1.4.6 - Multiple Vulnerabilities

WordPress Unite Gallery Lite plugin version 1.4.6 suffers from cross site request forgery and remote SQL injection vulnerabilities. Title: Cross-Site Request Forgery & SQL Injection Vulnerabilities in Unite Gallery Lite Wordpress Plugin v1.4.6 Submitter: Nitin Venkatesh Product: Unite Gallery Lit...

Cross site scripting

Cross-site scripting XSS vulnerability in the saveorder function in class-floating-social-bar.php in the Floating Social Bar plugin before 1.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the items parameter in an fsbsaveorder action to wp-admin/admin-ajax.ph...

PT-2015-6973

Name of the Vulnerable Software and Affected Versions Floating Social Bar plugin versions prior to 1.1.6 Description The issue is related to a cross-site scripting XSS vulnerability. It affects the save order function in the class-floating-social-bar.php file. Remote attackers can inject arbitrar...

CVE-2015-5528: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the saveorder function in class-floating-social-bar.php in the Floating Social Bar plugin before 1.1.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the items parameter in an fsbsaveorder action to wp-admin/admin-ajax.ph...

Sql injection

Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the mapName parameter in an e2mimgsavemapname action to wp-admin/admin-ajax.php and other unspecified vectors...

CVE-2015-4614

Multiple SQL injection vulnerabilities in includes/Function.php in the Easy2Map plugin before 1.2.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the mapName parameter in an e2mimgsavemapname action to wp-admin/admin-ajax.php and other unspecified vectors...

PT-2015-6641

Name of the Vulnerable Software and Affected Versions Easy2Map plugin versions prior to 1.2.5 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the mapName parameter in an 'e2m img save map name' action to the "/wp-admin/admin-ajax.php" API...

CVE-2015-5151

Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...

Cross site scripting

Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...

CVE-2014-9734: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Slider Revolution revslider plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php...

CVE-2015-5151: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...

PT-2015-6786

Name of the Vulnerable Software and Affected Versions Slider Revolution plugin version 4.2.2 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the client action parameter in a revslider ajax action action to "wp-admin/admin-ajax.php"...

WordPress Revslider 4.2.2 XSS / Information Disclosure Vulnerabilities

WordPress Revslider plugin version 4.2.2 suffer from cross site scripting, file download, and information disclosure vulnerabilities. Note that this finding houses site-specific data. | Title : WordPress Revslider 4.2.2 Multi Vulnerability | Author : indoushka | email : email protected | Dork :...

Directory traversal

Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a loadtemplate action to wp-admin/admin-ajax.php...

CVE-2015-4153

Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a loadtemplate action to wp-admin/admin-ajax.php...

CVE-2015-4153: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the zM Ajax Login & Register plugin before 1.1.0 for WordPress allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a loadtemplate action to wp-admin/admin-ajax.php...

PT-2015-6434

Name of the Vulnerable Software and Affected Versions zM Ajax Login & Register plugin versions prior to 1.1.0 Description The issue allows remote attackers to include and execute arbitrary php files via a relative path in the template parameter in a "load template" action to...

PT-2015-4052

Name of the Vulnerable Software and Affected Versions XCloner plugin version 3.1.1 for WordPress XCloner plugin version 3.5.1 for Joomla! Description A directory traversal issue exists, allowing remote administrators to read arbitrary files. This is achieved by using a .. dot dot in the file...

CVE-2014-8606: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. dot dot in the file parameter in a jsonreturn action in the xclonershow page to wp-admin/admin-ajax.php...