CVE-2026-5333: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file /admin/tools.php. The manipulation of the argument host results in command injection. The attack can be executed remotely. The exploit has been released to t...

CVE-2015-20115: Improper Neutralization of Input During Web Page Generation

Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing attackers to store malicious scripts through the file POST parameter in admin/tools.php. Attackers can upload files containing JavaScript code that executes in the context of admin/tools.php when accessed by...

EUVD-2015-9241

Malware in sbrugna...

CVE-2019-17207: Improper Neutralization of Input During Web Page Generation

A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker aka Broken Link Checker plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the...

PT-2019-15002

Name of the Vulnerable Software and Affected Versions broken-link-checker plugin version 1.11.8 Description A reflected XSS issue was found in the broken-link-checker plugin for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the s...

CVE-2015-9398

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection...

CVE-2015-9398

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection...

CVE-2015-9397

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS...

CVE-2015-9398: Improper Neutralization of Special Elements used in an SQL Command

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection...

PT-2019-7356

Name of the Vulnerable Software and Affected Versions gocodes plugin for WordPress versions through 1.3.5 Description The issue concerns a deletegc XSS in the wp-admin/tools.php file. This affects the gocodes plugin for WordPress, potentially allowing for cross-site scripting attacks...

PT-2019-7357

Name of the Vulnerable Software and Affected Versions gocodes plugin for WordPress versions through 1.3.5 Description The issue concerns a SQL injection vulnerability in the gocodes plugin for WordPress, specifically affecting the wp-admin/tools.php endpoint with the gcid parameter. This allows f...

CVE-2015-9397: Improper Neutralization of Input During Web Page Generation

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS...

PT-2019-7360

Name of the Vulnerable Software and Affected Versions websimon-tables plugin versions 1.3.4 and earlier Description The issue concerns a Cross-Site Scripting XSS vulnerability, specifically related to the edit style id parameter in the wp-admin/tools.php endpoint. This allows for potential...

CVE-2015-9401: Improper Neutralization of Input During Web Page Generation

The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php editstyle id XSS...

CVE-2016-10983

The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data...

PT-2019-7776

Name of the Vulnerable Software and Affected Versions WordPress ghost plugin versions prior to 0.5.6 Description The issue concerns a lack of access control in the ghost plugin for WordPress, allowing unauthorized downloads of exported data through the "wp-admin/tools.php?ghostexport=true"...

CVE-2016-10983: Improper Authentication

The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data...

CVE-2016-10944

The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF...

CVE-2016-10944: Cross-Site Request Forgery (CSRF)

The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF...

PT-2019-7737

Name of the Vulnerable Software and Affected Versions multisite-post-duplicator plugin versions prior to 1.1.3 Description The issue concerns a CSRF vulnerability in the multisite-post-duplicator plugin for WordPress. It affects the wp-admin/tools.php?page=mpd endpoint. Recommendations For versio...