139 matches found
Victor CMS 代码问题漏洞
Victor CMS is an open source content management system from the developers of Victor Alagwu Software in Nigeria. version 1.0 of Victor CMS is vulnerable to arbitrary file uploads. An attacker can execute arbitrary code by uploading files to CMS site-masteradminincludesadminaddpost.php...
CVE-2020-17999: Improper Neutralization of Input During Web Page Generation
Cross Site Scripting XSS in MiniCMS v1.10 allows remote attackers to execute arbitrary code by injecting commands via a crafted HTTP request to the component "/mc-admin/post-edit.php"...
MiniCMS 跨站脚本漏洞
MiniCMS is a content management system CMS designed for personal websites. A security vulnerability exists in MiniCMS v1.10 that allows remote attackers to execute arbitrary code by sending a crafted HTTP request injection command to the component "mc-admin post-edit.php"...
CVE-2020-35749
Directory traversal vulnerability in class-simplejobboardresumedownloadhandler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjbfile parameter to wp-admin/post.php...
CVE-2020-29303
A cross-site scripting XSS vulnerability in the SabaiApp Directories Pro plugin 1.3.45 for WordPress allows remote attackers to inject arbitrary web script or HTML via a POST to /wp-admin/admin.php?page=drts/directories&q=%2F with drtsformbuildid parameter containing the XSS payload and t paramet...
CVE-2019-18834
Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCSAdminPostTypes in class-wcs-admin-post-types.php...
CVE-2019-18834: Improper Neutralization of Input During Web Page Generation
Persistent XSS in the WooCommerce Subscriptions plugin before 2.6.3 for WordPress allows remote attackers to execute arbitrary JavaScript because Billing Details are mishandled in WCSAdminPostTypes in class-wcs-admin-post-types.php...
CVE-2020-11509
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37wplimporttemplate admin-post action which will execute in an administrator's browser if the template is used to create a page...
CVE-2020-11509
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37wplimporttemplate admin-post action which will execute in an administrator's browser if the template is used to create a page...
CVE-2020-11509
An XSS vulnerability in the WP Lead Plus X plugin through 0.98 for WordPress allows remote attackers to upload page templates containing arbitrary JavaScript via the c37wplimporttemplate admin-post action which will execute in an administrator's browser if the template is used to create a page...
PT-2020-12656 · WordPress · Wp Lead Plus X
Name of the Vulnerable Software and Affected Versions: WP Lead Plus X plugin versions through 0.98 Description: The issue allows remote attackers to upload page templates containing arbitrary JavaScript via the "c37 wpl import template" admin-post action. This JavaScript will execute in an...
CVE-2020-10195
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal...
Information disclosure
The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal...
CVE-2019-19982
The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...
WordPress Email Subscribers & Newsletters Unauthenticated Options Creation Vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers.Email Subscribers & Newsletters is an email subscription and newsletter plugin used in it. An unauthenticated option creation...
CVE-2015-9400: Improper Neutralization of Special Elements used in an SQL Command
The wordpress-meta-robots plugin through 2.1 for WordPress has wp-admin/post-new.php text SQL injection...
CVE-2016-10945
The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF...
PT-2019-7738 · Pagelines +1 · Pagelines +1
Name of the Vulnerable Software and Affected Versions: PageLines theme version 1.1.4 Description: The issue concerns a CSRF vulnerability in the PageLines theme for WordPress. It affects the "wp-admin/admin-post.php?page=pagelines" endpoint. Recommendations: For PageLines theme version 1.1.4,...
PT-2019-13831 · WordPress · Rank Math Seo
Name of the Vulnerable Software and Affected Versions: Rank Math SEO plugin version 1.0.27 Description: The issue allows non-admin users to reset settings. This is achieved via the wp-admin/admin-post.php endpoint, specifically through the reset-cmb parameter. Recommendations: For Rank Math SEO...