WordPress Plugin Webdorado Spider Event Calendar 1.4.9 - SQL Injection

. Exploit Title: WordPress: Webdorado Spider Event Calendar = 1.4.9 SQL Injection Date: 2015-02-12 Exploit Author: Mateusz Lach Vendor Homepage: https://www.facebook.com/WebDorado or http://www.webdorado.com Software Link: https://downloads.wordpress.org/plugin/spider-event-calendar.1.4.9.zip...

PT-2015-5578

Name of the Vulnerable Software and Affected Versions Apptha WordPress Video Gallery contus-video-gallery plugin versions prior to 2.8 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the vid parameter in a 'rss' action to the...

CVE-2015-1582

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

CVE-2015-1579

A directory traversal vulnerability exists in the Elegant Themes Divi theme for WordPress. The flaw stems from a failure to adequately filter the img parameter within the revslider_show_image action in the wp-admin/admin-ajax.php script. A remote attacker can use .. (dot dot) sequences to read ar...

CVE-2015-1582: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

CVE-2015-1579: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php. NOTE: this vulnerability may be a duplicate of CVE-2014-9734...

PT-2015-5369

Name of the Vulnerable Software and Affected Versions Spider Facebook plugin versions prior to 1.0.11 Description The issue allows remote attackers to inject arbitrary web script or HTML via certain parameters. Specifically, the appid parameter in a registration task to the default URI is...

Wordpress Video Gallery <= 2.7 - SQL Injection

The contus-video-gallery WordPress plugin was affected by a SQL Injection security vulnerability. http://example.com/wp-admin/admin-ajax.php?action=rss&type=video&vid=SQLi...

Photo Gallery <= 1.2.8 - Multiple Authenticated Reflected XSS

The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by a Multiple Authenticated Reflected XSS security vulnerability. /wp-admin/admin-ajax.php?action=addImages&width=700&height=550&extensions=jpg,jpeg,png,gif&callback=bwgaddpreviewimage&sortby=name";alert1...

Wordpress Theme Avada Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Theme Avada Arbitrary File Download Vulnerability Date: 19/01/2014 Exploit Author: Vylegzhanin Contact : email protected Tested on: Linux / Window Google Dork: inurl:wp-content/themes/avada PoC...

Wordpress Theme Pindol Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title: Wordpress Theme Pindol Arbitrary File Download Vulnerability Date: 18/01/2015 Exploit Author: t3rr0rist from GHC Georgian Hacking Community Contact : email protected Tested on: Linux Google Dork: inurl:"wp-content/themes/pindol/...

PT-2015-5042

Name of the Vulnerable Software and Affected Versions Photo Gallery plugin version 1.2.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the order by parameter in a GalleryBox action to the "/wp-admin/admin-ajax.php" API endpoint...

WordPress Photo Gallery Plugin <= 1.2.7 - SQL Injection

Because of this vulnerability, attackers to execute arbitrary SQL commands via the "orderby parameter" in a GalleryBox action to wp-admin/admin-ajax.php. Solution Update the plugin...

CVE-2015-1055: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the Photo Gallery plugin 1.2.7 for WordPress allows remote attackers to execute arbitrary SQL commands via the orderby parameter in a GalleryBox action to wp-admin/admin-ajax.php...

CVE-2014-10016

Multiple cross-site scripting XSS vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via 1 unspecified vectors related to purchaselimit or the 2 name, 3 intl, 4 nocod, or 5 time parameter in an adddeliverymethod acti...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via 1 unspecified vectors related to purchaselimit or the 2 name, 3 intl, 4 nocod, or 5 time parameter in an adddeliverymethod acti...

WordPress Welcart e-Commerce Plugin <= 1.3.12 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML in an adddeliverymethod action to wp-admin/admin-ajax.php via 4 parameters: "name", "intl", "nocod", or "time parameter". Solution Update the plugin...

PT-2015-3660

Name of the Vulnerable Software and Affected Versions Welcart e-Commerce plugin version 1.3.12 Description The issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors related to purchase limit or the name, intl, nocod, or time parameter in an "add delivery...

CVE-2014-10016: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via 1 unspecified vectors related to purchaselimit or the 2 name, 3 intl, 4 nocod, or 5 time parameter in an adddeliverymethod acti...