CVE-2014-7181

Cross-site scripting XSS vulnerability in the Max Foundry MaxButtons plugin before 1.26.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the maxbuttons-controller page to wp-admin/admin.php, related to the button creation pa...

PT-2014-7819

Name of the Vulnerable Software and Affected Versions MaxButtons plugin versions prior to 1.26.1 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the id parameter in a button action on the "maxbuttons-controller" page to...

CVE-2014-8294

Multiple SQL injection vulnerabilities in Voice Of Web AllMyGuests 0.4.1 allow remote attackers to execute arbitrary SQL commands via the 1 allmyphpcookie cookie to admin.php or the 2 Username or 3 Password...

CVE-2014-8294: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Voice Of Web AllMyGuests 0.4.1 allow remote attackers to execute arbitrary SQL commands via the 1 allmyphpcookie cookie to admin.php or the 2 Username or 3 Password...

PT-2014-8446

Name of the Vulnerable Software and Affected Versions Voice Of Web AllMyGuests version 0.4.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the allmyphp cookie cookie to admin.php, or through the Username or Password fields. Recommendatio...

Cross site scripting

Cross-site scripting XSS vulnerability in the WooCommerce plugin before 2.2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the range parameter on the wc-reports page to wp-admin/admin.php...

CVE-2014-8766: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in Allomani Weblinks 1.0 allow remote attackers to execute arbitrary SQL commands via the 1 cat parameter in a browse action to index.php or 2 unspecified parameters to admin.php...

PT-2014-7147

Name of the Vulnerable Software and Affected Versions WooCommerce plugin versions prior to 2.2.3 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the range parameter on the "wc-reports" page to "wp-admin/admin.php". Recommendations Fo...

PT-2014-8721

Name of the Vulnerable Software and Affected Versions Allomani Weblinks version 1.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the cat parameter in a browse action to "index.php" or via unspecified parameters to "admin.php"...

CVE-2014-7139

Multiple cross-site scripting XSS vulnerabilities in the Contact Form DB aka CFDB and contact-form-7-to-database-extension plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 form or 2 enc parameter in the CF7DBPluginShortCodeBuilder page to...

CVE-2014-7139: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Contact Form DB aka CFDB and contact-form-7-to-database-extension plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 form or 2 enc parameter in the CF7DBPluginShortCodeBuilder page to...

PT-2014-7115

Name of the Vulnerable Software and Affected Versions All In One WP Security & Firewall plugin versions prior to 3.8.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands via the orderby or order parameter in the aiowpsec page to wp-admin/admin.php. This can ...

Sql injection

SQL injection vulnerability in the editgallery function in admin/galleryfunc.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the removeslide parameter to wp-admin/admin.php...

PT-2014-7808

Name of the Vulnerable Software and Affected Versions Huge-IT Image Gallery plugin version 1.0.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the removeslide parameter to the "/wp-admin/admin.php" API endpoint. Recommendations For...

CVE-2014-7153: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the editgallery function in admin/galleryfunc.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the removeslide parameter to wp-admin/admin.php...

HDW Player 2.4.2 - wp-admin/admin.php videos Page id Parameter SQL Injection

The HDW Player Plugin Video Player & Video Gallery WordPress plugin was affected by a wp-admin/admin.php videos Page id Parameter SQL Injection security vulnerability...

Sql injection

SQL injection vulnerability in lib/admin.php in tenfourzero Shutter 0.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-3904

CVE-2014-3904 affects Shutter 0.1.4 (tenfourzero). The vulnerability is a SQL injection in lib/admin.php that enables remote attackers to execute arbitrary SQL commands via unspecified vectors. Impact is described as possible arbitrary SQL execution with administrative context, potentially affect...

CVE-2014-3904: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in lib/admin.php in tenfourzero Shutter 0.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

JVN#48039501: Shutter vulnerable to SQL injection

Shutter provided by tenfourzero is a web package allowing users to share their photos. lib/admin.php in Shutter contains a SQL injection vulnerability. Impact If an administrator views a malicious page while logged in, an arbitrary SQL command may be executed. Solution Uninstall the Software...