CVE-2014-4516

The CVE-2014-4516 entry affects the WordPress BIC Media Widget plugin (

WordPress MoodThingy Widget 0.8.7 - Blind SQL Injection

No description provided by source. Exploit Title: WordPress MoodThingy Mood Rating Widget v0.8.7 Blind SQL Injection Date: 7/2/12 Exploit Author: Chris Kellum Vendor Homepage: http://www.moodthingy.com/ Software Link: http://downloads.wordpress.org/plugin/moodthingy-mood-rating-widget.0.8.7.zip...

Yahoo! Widget < 4.0.5 GetComponentVersion() Remote Overflow Exploit

No description provided by source. html !-- +++++++++++++++++++++++ +Last Modified by lhoang8500++ +++++++++++++++++++++++ -- html object classid=CLSID:7EC7B6C5-25BD-4586-A641-D2ACBB6629DD id=target/OBJECT SCRIPT language=javascript var heapSprayToAddress = 0x05050505; var payLoadCode =...

WordPress Website FAQ Plugin 1.0 - SQL Injection

No description provided by source. Exploit Title: WordPress Website FAQ Plugin v1.0 SQL Injection Date: 6/25/12 Exploit Author: Chris Kellum Vendor Homepage: http://wordpress.org/extend/plugins/website-faq/ Software Link: http://downloads.wordpress.org/plugin/website-faq.zip Version: 1.0...

Wordpress Mini Mail Dashboard Widget Plugin 1.36 Remote File Inclusion

No description provided by source. Exploit Title: Mini Mail Dashboard Widget Wordpress plugin RFI Google Dork: inurl:wp-content/plugins/mini-mail-dashboard-widget Date: 09/19/2011 Author: Ben Schmidt supernothing AT spareclockcycles.org @supernothing Software Link:...

Widget Property 1.1.19 Property.PHP SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/15701/info Widget Press Widget Property is prone to an SQL injection vulnerability. This issue is due to a failure in the application to properly sanitize user-supplied input to the 'property.php' script before using it i...

ProfileCMS <= 1.0 (id) Remote SQL Injection Vulnerability

No description provided by source. \ /\ \ / | \ \ | / \ // / | \ | \ \ Y / | \ / / \ /| /\ / / / / / .OR.ID ECHOADV84$2007 ----------------------------------------------------------------------------------------- ECHOADV84$2007 ProfileCMS = 1.0 Remote SQL Injection Vulnerability...

PT-2014-5946

Name of the Vulnerable Software and Affected Versions BIC Media Widget plugin version 1.0 and earlier Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the param parameter in the...

WordPress KNR Author List Widget plugin <= 2.0.0 - SQL Injection Vulnerability

No description provided by source. Exploit Title: WordPress KNR Author List Widget plugin = 2.0.0 SQL Injection Vulnerability Date: 2011-09-06 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/knr-author-list-widget.zip Version:...

PT-2014-5997

Name of the Vulnerable Software and Affected Versions WP-Contact wp-contact-sidebar-widget plugin version 1.0 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via vulnerable parameters in forms/messages.php. The vulnerable parameters include edit,...

CVE-2014-4516: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in bicm-carousel-preview.php in the BIC Media Widget plugin 1.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the param parameter...

Important: Red Hat Security Advisory: cfme security, bug fix, and enhancement update

Updated cfme packages that fix several security issues, multiple bugs, and add one enhancement are now available for Red Hat CloudForms 3.0. The Red Hat Security Response Team has rated this update as having Important security impact. Common Vulnerability Scoring System CVSS base scores, which gi...

Wordpress TimThumb 2.8.13 WebShot - Remote Code Execution Exploit

Exploit for php platform in category web applications | | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Wordpress TimThumb 2.8.13 WebShot Remote Code Execution 0-day Affected website : a lot Wordpress Themes, Plugins, 3rd party components...

Multiple WordPress Plugins (TimThumb 2.8.13 / WordThumb 1.07) - 'WebShot' Remote Code Execution

| | / | \ | |/ |/ | / | | | | | | | | | | | | | / \ | | | || || | |\ | || | | / | | |/|| ||// \| Wordpress TimThumb 2.8.13 WebShot Remote Code Execution 0-day Affected website : a lot Wordpress Themes, Plugins, 3rd party components Exploit Author : @u0x Pichaya Morimoto Release dates :...

WordPress BIC Media Widget Plugin <= 1.0 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "param" parameter. Solution Update the plugin...

Widget Corp CMS SQL Injection

Sql Injection on Widget Corp CMS + Date: 14/06/2014 + CWE Number : CWE-89 + Risk: High + Author: Felipe Andrian Peixoto + Vendor Homepage: http://www.standardwidget.com/ + Contact: [email protected] + Tested on: Windows 7 and Linux + Vulnerable Files: index.php + Dork : intitle:"Widget...

Code injection

The autocomplete callback in Autocomplete Widgets for Text and Number Fields autocompletewidgets module 6.x-1.x before 6.x-1.4 and 7.x-1.x before 7.x-1.0-rc1 does not properly handle node permissions, which allows remote authenticated users to obtain sensitive field values via unspecified vectors...

PT-2014-5481

Name of the Vulnerable Software and Affected Versions Mumble versions 1.2.x through 1.2.5 Description The issue allows remote attackers to cause a denial of service, resulting in hang and resource consumption, by forcing the loading of an external file via a crafted string treated as rich-text by...

Jrss Widget <= 1.2 - SSRF

Plugin is still affected and has been closed...

Design/Logic Flaw

typeswidget.py in Plone 2.1 through 4.1, 4.2.x through 4.2.5, and 4.3.x through 4.3.1 does not properly enforce the immutable setting on unspecified content edit forms, which allows remote attackers to hide fields on the forms via a crafted URL...