CVE-2018-15843

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

CVE-2018-15843

GetSimple CMS 3.3.14 is vulnerable to Cross-Site Scripting (XSS) through the admin/edit.php “Add New Page” field. The CNVD entry attributes the issue to inadequate filtering of the Add New Page input in GetSimple CMS 3.3.14, enabling a remote attacker to inject arbitrary web script or HTML. The C...

CVE-2018-15843: Improper Neutralization of Input During Web Page Generation

GetSimple CMS 3.3.14 has XSS via the admin/edit.php "Add New Page" field...

PT-2018-13232

Name of the Vulnerable Software and Affected Versions GetSimple CMS version 3.3.14 Description The issue is related to a Cross-Site Scripting XSS problem. It occurs in the admin/edit.php file, specifically through the "Add New Page" field. Recommendations For GetSimple CMS version 3.3.14, update ...

CVE-2017-9603: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the WP Jobs plugin before 1.5 for WordPress allows authenticated users to execute arbitrary SQL commands via the jobid parameter to wp-admin/edit.php...

PT-2017-19063

Name of the Vulnerable Software and Affected Versions WP Jobs plugin version 1.4 and earlier Description The issue allows authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the jobid parameter in the /wp-admin/edit.php endpoint. Recommendations For WP Jobs plugi...

Directory traversal

Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. dot dot in the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

CVE-2015-5481

The CVE-2015-5481 entry documents a Cross-site scripting (XSS) vulnerability in the GD bbPress Attachments WordPress plugin. Affects versions prior to 2.3, vulnerable code resides in forms/panels.php where the tab parameter of gdbbpress_attachments (on wp-admin/edit.php) is not properly filtered,...

PT-2015-6936

Name of the Vulnerable Software and Affected Versions GD bbPress Attachments plugin versions prior to 2.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the tab parameter in the gdbbpress...

PT-2015-6938

Name of the Vulnerable Software and Affected Versions Modern Tribe Eventbrite Tickets plugin versions prior to 3.10.2 Description The issue is related to a cross-site scripting XSS vulnerability in the Event Import page. This vulnerability allows remote attackers to inject arbitrary web script or...

PT-2015-6937

Name of the Vulnerable Software and Affected Versions GD bbPress Attachments plugin versions prior to 2.3 Description The issue allows remote administrators to include and execute arbitrary local files. This can be achieved by using a .. dot dot in the tab parameter in the "gdbbpress attachments"...

CVE-2015-5355

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 post-content or 2 post-title parameter to admin/edit.php...

CVE-2015-5355

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 post-content or 2 post-title parameter to admin/edit.php...

PT-2015-6862

Name of the Vulnerable Software and Affected Versions GetSimple CMS versions prior to 3.3.6 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. The vulnerable parameters are...

CVE-2015-5355: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in GetSimple CMS before 3.3.6 allow remote attackers to inject arbitrary web script or HTML via the 1 post-content or 2 post-title parameter to admin/edit.php...

PT-2015-3630

Name of the Vulnerable Software and Affected Versions mTouch Quiz versions prior to 3.0.7 Description The issue allows remote attackers to inject arbitrary web script or HTML via the quiz parameter to the "wp-admin/edit.php" endpoint. This can be exploited by sending malicious input to the...

PT-2015-3629

Name of the Vulnerable Software and Affected Versions mTouch Quiz versions prior to 3.0.7 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the quiz parameter in the wp-admin/edit.php endpoint. Recommendations For versions prior to...

PT-2015-4264

Name of the Vulnerable Software and Affected Versions Our Team Showcase our-team-enhanced plugin versions prior to 1.3 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for requests, enabling them to change plugin settings or conduct...

CVE-2014-9523: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Our Team Showcase our-team-enhanced plugin before 1.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site...

PT-2015-3475

Name of the Vulnerable Software and Affected Versions Kandidat CMS version 1.4.2 Description The issue allows remote attackers to hijack the authentication of administrators for requests. This can be achieved through multiple cross-site request forgery CSRF vulnerabilities. Specifically, the...