35966 matches found
CVE-2015-9478
prettyPhoto before 3.1.6 has js/jquery.prettyPhoto.js XSS...
CVE-2015-9467
The broken-link-manager plugin before 0.5.0 for WordPress has wpslDelURL or wpslEditURL SQL injection via the url parameter...
CVE-2015-9471
The dzs-zoomsounds plugin through 2.0 for WordPress has admin/upload.php arbitrary file upload...
CVE-2015-9476
The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates...
CVE-2015-9480
The WordPress RobotCPA Plugin v5 is affected by a directory traversal (CVE-2015-9480) via the f.php?l parameter. The Nuclei template and related sources describe a path traversal vulnerability allowing an attacker to access restricted server files, enabling potential data leakage. The vulnerabili...
CVE-2015-9480
The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter...
CVE-2015-9479
The CVE-2015-9479 issue affects the WordPress ACF-Frontend-Display plugin (versions up to 2015-07-03): it allows arbitrary file upload through an action=upload request to js/blueimp-jQuery-File-Upload-d45deb1/server/php/index.php. Connected documents confirm the vulnerability description; no expl...
CVE-2015-9478
CVE-2015-9478 affects prettyPhoto prior to 3.1.6, specifically the getHashtag function in js/jquery.prettyPhoto.js, enabling a DOM-based XSS when user-supplied data after the # is not encoded. Impact is described as XSS with partial integrity/low confidentiality impact in public CVE notes; exact ...
CVE-2015-9476
CVE-2015-9476 involves WordPress Teardrop theme (v1.8.1) with insufficient restrictions on option updates. The vulnerability allows privilege escalation by any authenticated user who can trigger option changes (e.g., altering default_role, registration state), enabling command/code execution on t...
CVE-2015-9476
The Teardrop theme 1.8.1 for WordPress has insufficient restrictions on option updates...
CVE-2015-9475
The CVE-2015-9475 entry corresponds to the Pont theme 1.5 for WordPress, which has insufficient restrictions on option updates. Connected sources describe a privilege-escalation vulnerability where any authenticated user can trigger option changes (e.g., user roles, registration state) via expose...
CVE-2015-9474
The CVE-2015-9474 issue affects the WordPress Simpolio theme (version 1.3.2), where insufficient restrictions on option updates enable privilege escalation. The public sets show that an attacker with any authenticated user can trigger the vulnerability by manipulating theme options (e.g., default...
CVE-2015-9464
The s3bubble-amazon-s3-html-5-video-with-adverts plugin 0.7 for WordPress has directory traversal via the adverts/assets/plugins/ultimate/content/downloader.php path parameter...
CVE-2015-9458
The searchterms-tagging-2 plugin through 1.535 for WordPress has SQL injection via the pkstt2dbgetpopularterms count parameter exploitable via CSRF...
CVE-2015-9460
The booking-system plugin before 2.1 for WordPress has DOPBSPBackEndTranslation::display SQL injection via the language parameter...
CVE-2015-9461
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afpgetnewportfolioitempage SQL injection via the itemid parameter...
CVE-2015-9473
CVE-2015-9473 concerns the WordPress estrutura-basica theme (up to 2015-09-13) with a directory traversal flaw in the scripts/download.php arquivo parameter. The root cause is improper handling of file paths, enabling retrieval of local files via this parameter. Public references in the provided ...
CVE-2015-9472
CVE-2015-9472 affects the WordPress incoming-links plugin prior to 0.9.10b, where referrers.php XSS is triggered via the Referer HTTP header. Multiple connected sources (NVD, RH, CNVD, CVE listings) confirm a cross-site scripting vulnerability in this plugin. Public details describe the flaw and ...
CVE-2015-9471
CVE-2015-9471 affects the WordPress plugin dzs-zoomsounds (2.0), where an admin/upload.php arbitrary file upload vulnerability exists. The issue is tied to the dzs-zoomsounds WordPress plugin and results in potential unauthorized file uploads via its admin interface. The initial description state...