35966 matches found
CVE-2015-9430
CVE-2015-9430 affects the Crazy Bone WordPress plugin (before version 0.6.0). The issue is an XSS vulnerability via the User-Agent HTTP header. Multiple connected sources confirm the same root cause and affected component. The wpvulndb entry additionally aligns with stored XSS scenarios for earli...
CVE-2015-9429
CVE-2015-9429 concerns the WordPress plugin YITH Maintenance Mode (before 1.2.0). The issue is a CSRF that leads to an XSS via the parameter panel_page in the page wp-admin/themes.php?page=yith-maintenance-mode. Affected products/versions: WordPress plugin versions prior to 1.2.0. Documented impa...
CVE-2015-9428
The vulnerability CVE-2015-9428 affects the WordPress plugin wplegalpages (pre-1.1). It enables a CSRF that can result in a XSS via admin.php?page=legal-pages with parameters such as lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-nich...
CVE-2015-9426
The CVE affects the WordPress plugin Manual Image Crop (pre-1.11). It describes a CSRF vulnerability that can lead to an XSS condition via wp-admin/admin-ajax.php?action=mic_editor_window with the postId parameter. Affected component: manual-image-crop plugin for WordPress; root cause: CSRF enabl...
CVE-2015-9424
CVE-2015-9424 affects the WordPress Multicons plugin prior to 3.0. The vulnerability is CSRF that can yield XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter. Documented impacts include XSS with no availability impact, with a CVSS 3.1 base s...
CVE-2015-9423
The CVE-2015-9423 entry concerns the PlugNedit Adaptive Editor WordPress plugin (pre-6.2.0) and a reflected/Stored XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load with parameters such as PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plu...
CVE-2015-9422
The CVE-2015-9422 entry concerns the PlugNedit Adaptive Editor WordPress plugin prior to 6.2.0. The vulnerability is a CSRF that can yield XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load and the parameters plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditE...
CVE-2015-9414
The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/getalbumitem.php?size parameter...
CVE-2015-9415
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion...
CVE-2015-9421
The CVE refers to the Olevmedia Shortcodes WordPress plugin. It is affected by a CSRF-induced XSS vulnerability in versions before 1.1.9, exploitable via wp-admin/admin-ajax.php?action=omsc_popup id parameter. The issue arises from a CSRF weakness that can trigger script execution in the context ...
CVE-2015-9420
The CVE concerns the WordPress plugin “soundcloud-is-gold” (pre-2.3.2). The vulnerability is an XSS via wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter, leading to unauthenticated reflected XSS. Affected versions are plugin versions before 2.3.2; the issue is caused by improper ...
CVE-2015-9419
CVE-2015-9419 affects the Captain Slider WordPress plugin, version 1.0.6, which is vulnerable to cross-site scripting via a Title or Caption section. The NVD records CVSS v2 base score 4.3 (MEDIUM) and CVSS v3.1 base score 6.1 (MEDIUM). No exploitation status or patches are detailed in the provid...
ABRT - sosreport Privilege Escalation Exploit
This Metasploit module attempts to gain root privileges on RHEL systems with a vulnerable version of Automatic Bug Reporting Tool ABRT configured as the crash handler. sosreport uses an insecure temporary directory, allowing local users to write to arbitrary files CVE-2015-5287. This module has...
CVE-2015-9416
CVE-2015-9416 affects the WordPress WPML plugin (sitepress-multilingual-cms) versions 2.9.3–3.2.6. Affected component: WPML; root cause: cross-site scripting via the Accept-Language HTTP header. Impact: allows execution of client-side code in victims’ browsers (XSS). Notable sources corroborate X...
CVE-2015-9415
Vulnerability context: The BJ Lazy Load plugin for WordPress (versions before 1.0) has a Remote File Inclusion (RFI) vulnerability via TimThumb. The connected nuclei template explicitly notes RFI through TimThumb in BJ Lazy Load
CVE-2015-9415
The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion...
CVE-2015-9414
WordPress WP Symposium plugin (
CVE-2015-9413
The CVE-2015-9413 issue affects the WordPress eShop plugin (versions up to 6.3.13). The vulnerability is a CSRF that can cause a reflected XSS via the parameter title in wp-admin/admin.php?page=eshop-downloads.php. The root cause is CSRF enabling an attacker to induce unintended requests that, un...
CVE-2015-9412
CVE-2015-9412 affects the WordPress plugin Royal-Slider (vulnerable: before 3.2.7). The issue is an XSS in the site’s admin UI via the rstype parameter when creating/editing a slider. Several connected sources corroborate: Red Hat and CNVD entries describe the same XSS in the Royal-Slider plugin;...