CVE-2014-9524: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Facebook Like Box cardoza-facebook-like-box plugin before 2.8.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct...

PT-2015-3476

Name of the Vulnerable Software and Affected Versions MemHT Portal version 4.0.1 Description The issue allows remote attackers to hijack the authentication of administrators for requests. This can be achieved through multiple cross-site request forgery CSRF vulnerabilities that enable modificatio...

CVE-2010-5320: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in MemHT Portal 4.0.1 allow remote attackers to hijack the authentication of administrators for requests that 1 modify settings via a configuration action to admin.php, 2 modify articles via an articles action to admin.php, or 3 modify...

CVE-2014-9437

Multiple cross-site request forgery CSRF vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site scripting XSS attacks via...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Sliding Social Icons plugin 1.61 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or 2 conduct cross-site scripting XSS attacks via...

Sql injection

Multiple SQL injection vulnerabilities in Absolut Engine 1.73 allow remote authenticated users to execute arbitrary SQL commands via the 1 sectionID parameter to admin/managersection.php, 2 userID parameter to admin/edituser.php, 3 username parameter to admin/admin.php, or 4 title parameter to...

CVE-2014-9414

The W3 Total Cache plugin before 0.9.4.1 for WordPress does not properly handle empty nonces, which allows remote attackers to conduct cross-site request forgery CSRF attacks and hijack the authentication of administrators for requests that change the mobile site redirect URI via the...

WordPress Shareaholic Plugin <= 7.6.0 - XSS

This vulnerability is in admin.php. It allows authenticated users to inject arbitrary web script or HTML via the "locationid" parameter that is in a shareaholicaddlocation action to wp-admin/admin-ajax.php. Solution Update the plugin...

CVE-2014-9097: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Apptha WordPress Video Gallery contus-video-gallery plugin 2.5, possibly as distributed before 2014-07-23, for WordPress allow 1 remote attackers to execute arbitrary SQL commands via the vid parameter in a myextract action to wp-admin/admin-ajax.php ...

CVE-2014-7837

mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to remove wiki pages by leveraging delete access within a different subwiki...

CVE-2014-7837: Undefined Security Weakness

mod/wiki/admin.php in Moodle through 2.4.11, 2.5.x before 2.5.9, 2.6.x before 2.6.6, and 2.7.x before 2.7.3 allows remote authenticated users to remove wiki pages by leveraging delete access within a different subwiki...

PT-2014-8304

Name of the Vulnerable Software and Affected Versions Moodle versions 2.4.11 and earlier, 2.5.x before 2.5.9, 2.6.x before 2.6.6, 2.7.x before 2.7.3 Description The issue allows remote authenticated users to remove wiki pages by leveraging delete access within a different subwiki, specifically...

PT-2014-8778

Name of the Vulnerable Software and Affected Versions XOOPS versions prior to 2.5.7 Final Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the selgroups parameter in the /htdocs/modules/system/admin.php API endpoint. Recommendations F...

CVE-2014-8999: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in htdocs/modules/system/admin.php in XOOPS before 2.5.7 Final allows remote authenticated users to execute arbitrary SQL commands via the selgroups parameter...

PT-2014-6049

Name of the Vulnerable Software and Affected Versions Wordfence Security plugin versions prior to 5.1.4 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to...

PT-2014-8640

Name of the Vulnerable Software and Affected Versions Allomani Weblinks version 1.0 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the default URI to admin.php, the id parameter to admin.php, or go.php. Recommendations For Allomani...

CVE-2014-8593: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Allomani Weblinks 1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 default URI to admin.php or the 2 id parameter to admin.php or 3 go.php...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML via the polyid parameter in an 1 editpoly, 2 editpolyline, or 3 editmarker action in the wp-google-maps-menu page to...

CVE-2014-7182: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the WP Google Maps plugin before 6.0.27 for WordPress allow remote attackers to inject arbitrary web script or HTML via the polyid parameter in an 1 editpoly, 2 editpolyline, or 3 editmarker action in the wp-google-maps-menu page to...

Cross site scripting

Cross-site scripting XSS vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation pa...