CVE-2015-9435

The CVE-2015-9435 entry concerns the WordPress plugin oauth2-provider (before 3.1.5). The vulnerability arises from incorrect generation of random numbers (insecure pseudorandom number generation) in the plugin, as documented across multiple sources. Impact ranges from Partial confidentiality, in...

CVE-2015-9433

The wp-social-bookmarking-light plugin for WordPress is affected by a CSRF leading to XSS via configuration parameters in wp-admin/options-general.php?page=wp-social-bookmarking-light/modules/admin.php. This vulnerability exists in versions prior to 1.7.10. Root cause: CSRF enables insertion of m...

CVE-2015-9431

The CVE concerns the WordPress plugin qtranslate-x. A CSRF flaw in qtranslate-x prior to version 3.4.4 allows an attacker to induce XSS via requests to wp-admin/options-general.php?page=qtranslate-x with json_config_files or json_custom_i18n_config parameters. This is described in multiple source...

CVE-2015-9449

The CVE concerns the WordPress plugin Microblog Poster (versions before 1.6.2). A SQL Injection vulnerability exists in the plugin’s admin page (wp-admin/options-general.php?page=microblogposter.php account_id parameter) due to insufficient input validation. Public sources describe the issue as a...

CVE-2015-9449

The microblog-poster plugin before 1.6.2 for WordPress has SQL Injection via the wp-admin/options-general.php?page=microblogposter.php accountid parameter...

CVE-2015-9430

CVE-2015-9430 affects the Crazy Bone WordPress plugin (before version 0.6.0). The issue is an XSS vulnerability via the User-Agent HTTP header. Multiple connected sources confirm the same root cause and affected component. The wpvulndb entry additionally aligns with stored XSS scenarios for earli...

CVE-2015-9429

CVE-2015-9429 concerns the WordPress plugin YITH Maintenance Mode (before 1.2.0). The issue is a CSRF that leads to an XSS via the parameter panel_page in the page wp-admin/themes.php?page=yith-maintenance-mode. Affected products/versions: WordPress plugin versions prior to 1.2.0. Documented impa...

CVE-2015-9428

The vulnerability CVE-2015-9428 affects the WordPress plugin wplegalpages (pre-1.1). It enables a CSRF that can result in a XSS via admin.php?page=legal-pages with parameters such as lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-nich...

CVE-2015-9426

The CVE affects the WordPress plugin Manual Image Crop (pre-1.11). It describes a CSRF vulnerability that can lead to an XSS condition via wp-admin/admin-ajax.php?action=mic_editor_window with the postId parameter. Affected component: manual-image-crop plugin for WordPress; root cause: CSRF enabl...

CVE-2015-9424

CVE-2015-9424 affects the WordPress Multicons plugin prior to 3.0. The vulnerability is CSRF that can yield XSS via the wp-admin/options-general.php?page=multicons%2Fmulticons.php global_url or admin_url parameter. Documented impacts include XSS with no availability impact, with a CVSS 3.1 base s...

CVE-2015-9423

The CVE-2015-9423 entry concerns the PlugNedit Adaptive Editor WordPress plugin (pre-6.2.0) and a reflected/Stored XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load with parameters such as PlugneditBGColor, PlugneditEditorMargin, plugnedit_width, pnemedcount, or plu...

CVE-2015-9422

The CVE-2015-9422 entry concerns the PlugNedit Adaptive Editor WordPress plugin prior to 6.2.0. The vulnerability is a CSRF that can yield XSS via wp-admin/admin-ajax.php?action=simple_fields_field_type_post_dialog_load and the parameters plugnedit_width, pnemedcount, PlugneditBGColor, PlugneditE...

CVE-2015-9414

The wp-symposium plugin through 15.8.1 for WordPress has XSS via the wp-content/plugins/wp-symposium/getalbumitem.php?size parameter...

CVE-2015-9415

The bj-lazy-load plugin before 1.0 for WordPress has Remote File Inclusion...

CVE-2015-9421

The CVE refers to the Olevmedia Shortcodes WordPress plugin. It is affected by a CSRF-induced XSS vulnerability in versions before 1.1.9, exploitable via wp-admin/admin-ajax.php?action=omsc_popup id parameter. The issue arises from a CSRF weakness that can trigger script execution in the context ...

CVE-2015-9420

The CVE concerns the WordPress plugin “soundcloud-is-gold” (pre-2.3.2). The vulnerability is an XSS via wp-admin/admin-ajax.php?action=get_soundcloud_player id parameter, leading to unauthenticated reflected XSS. Affected versions are plugin versions before 2.3.2; the issue is caused by improper ...

CVE-2015-9419

CVE-2015-9419 affects the Captain Slider WordPress plugin, version 1.0.6, which is vulnerable to cross-site scripting via a Title or Caption section. The NVD records CVSS v2 base score 4.3 (MEDIUM) and CVSS v3.1 base score 6.1 (MEDIUM). No exploitation status or patches are detailed in the provid...

ABRT - sosreport Privilege Escalation Exploit

This Metasploit module attempts to gain root privileges on RHEL systems with a vulnerable version of Automatic Bug Reporting Tool ABRT configured as the crash handler. sosreport uses an insecure temporary directory, allowing local users to write to arbitrary files CVE-2015-5287. This module has...

CVE-2015-9416

CVE-2015-9416 affects the WordPress WPML plugin (sitepress-multilingual-cms) versions 2.9.3–3.2.6. Affected component: WPML; root cause: cross-site scripting via the Accept-Language HTTP header. Impact: allows execution of client-side code in victims’ browsers (XSS). Notable sources corroborate X...

CVE-2015-9415

The bj-lazy-load plugin for WordPress (versions prior to 1.0 ) is vulnerable to Remote File Inclusion (RFI) via the TimThumb component. An attacker can exploit this improper input validation to include and execute remote malicious files, which may lead to remote code execution (RCE) and a complet...