CVE-2018-11632

The CVE-2018-11632 issue affects the WordPress plugin Add Social Share Messenger Buttons Whatsapp and Viber (version 1.0.8) by lack of nonce/capability checks in whatsapp_share_setting_add_update(), enabling CSRF to change settings when an admin visits a crafted URL via spear phishing/social engi...

CVE-2018-11632: Cross-Site Request Forgery (CSRF)

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings via...

CVE-2018-10423: Exposure of Sensitive Information to an Unauthorized Actor

mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article...

MiniCMS Information Disclosure Vulnerability (CNVD-2018-08993)

MiniCMS is a mini content management system CMS designed for personal websites. An information disclosure vulnerability exists in the mc-admin/post.php file in MiniCMS version 1.10. A remote attacker can exploit this vulnerability to view all files located in the web root path...

watpho.com XSS vulnerability

Open Bug Bounty ID: OBB-606200 Description| Value ---|--- Affected Website:| watpho.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-5312: Improper Neutralization of Input During Web Page Generation

The tabs-responsive plugin 1.8.0 for WordPress has XSS via the posttitle parameter to wp-admin/post.php...

CVE-2018-5212: Improper Neutralization of Input During Web Page Generation

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdmuploadthumbnail aka File Thumbnail parameter in an edit action to wp-admin/post.php...

CVE-2018-5213: Improper Neutralization of Input During Web Page Generation

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdmupload aka Downloadable File parameter in an edit action to wp-admin/post.php...

chiangmaifishing.com XSS vulnerability

Open Bug Bounty ID: OBB-428595 Description| Value ---|--- Affected Website:| chiangmaifishing.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

WordPress: Arbitrary file deletion in wp-core - guides towards RCE and information disclosure

Vulnerable place 1: wp-admin/post.php $newmeta'thumb' is placed into DB not sanitized directly from user input. case 'editattachment': checkadminreferer'update-post' . $postid; // Don't let these be changed unset$POST'guid'; $POST'posttype' = 'attachment'; // Update the thumbnail filename $newmet...

Privilege Escalation

WordPress is vulnerable to privilege escalation attacks. The attacks are possible through changing the userID parameter in wp-admin/includes/post.php, allowing any authenticated users to create a post as if written by another user...

Upworthy Clone Script 1.1.0 - id SQL Injection

Upworthy Clone Script 1.1.0 - id SQL Injection Exploit Title: Flippy BuzzWorthy – Upworthy Clone Script v1.1.0 - SQL Injection Google Dork: N/A Date: 06.02.2017 Vendor Homepage: https://www.flippyscripts.com/ Software Buy: https://www.flippyscripts.com/flippy-buzzworthy-upworthy-clone-script/ Dem...

Funny Image and Video Script 2.0.0 - 'id' SQL Injection

Exploit Title: Flippy ChillOut – Funny Image and Video Script v2.0.0 - SQL Injection Google Dork: N/A Date: 06.02.2017 Vendor Homepage: https://www.flippyscripts.com/ Software Buy: https://www.flippyscripts.com/flippy-chillout-funny-image-and-video-script/ Demo: http://chillout.flippydemos.com/...

Upworthy Clone Script 1.1.0 - 'id' SQL Injection

Exploit Title: Flippy BuzzWorthy – Upworthy Clone Script v1.1.0 - SQL Injection Google Dork: N/A Date: 06.02.2017 Vendor Homepage: https://www.flippyscripts.com/ Software Buy: https://www.flippyscripts.com/flippy-buzzworthy-upworthy-clone-script/ Demo: http://buzzworthy.flippydemos.com/ Version:...

VbmCMS system post.php file the catid parameter SQL injection vulnerability

No description provided by source...

VBcms /post.php SQL注入

No description provided by source...

CVE-2015-3273

mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization...

CVE-2015-2213

SQL injection vulnerability in the wpuntrashpostcomments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash...

WordPress 4.2.3 and earlier SQL Injection Vulnerability

Exploit for php platform in category web applications A potential SQL injection that could be used to compromise a site FIX: trunk/src/wp-includes/post.php foreach $groupbystatus as $status = $comments // Sanity check. This shouldn't happen. - if 'post-trashed' == $status + if 'post-trashed' ==...

DEBIAN-CVE-2015-5623

WordPress before 4.2.3 does not properly verify the editposts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php...