CVE-2014-9337: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in the Mikiurl Wordpress Eklentisi plugin 2.0 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the 1 twitterkullanici or 2...

PT-2014-8941

Name of the Vulnerable Software and Affected Versions O2Tweet plugin versions 0.0.4 and earlier Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks. This is achieved via the o2t username or o2t tag...

PT-2014-8827

Name of the Vulnerable Software and Affected Versions WhyDoWork AdSense plugin version 1.2 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the idcode parameter in the "whydowork adsense" page to...

CVE-2014-9100: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the idcode parameter in the whydoworkadsense page to wp-admin/options-general.php...

CVE-2014-9099: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the WhyDoWork AdSense plugin 1.2 for WordPress allows remote attackers to hijack the authentication of administrators for requests that have unspecified impact via a request to the whydoworkadsense page in wp-admin/options-general.php...

CVE-2014-2559: Cross-Site Request Forgery (CSRF)

Multiple cross-site request forgery CSRF vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to wp-admin/options-general.php...

PT-2014-4780

Name of the Vulnerable Software and Affected Versions Twitget plugin versions prior to 3.3.3 Description The issue allows remote attackers to hijack the authentication of administrators for requests that change unspecified plugin options via a request to "wp-admin/options-general.php". This is du...

PT-2014-5010

Name of the Vulnerable Software and Affected Versions Twitget plugin versions prior to 3.3.3 Description The issue allows remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors. This can be demonstrated by the twitget consumer key parameter to...

CVE-2014-2995: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in twitget.php in the Twitget plugin before 3.3.3 for WordPress allow remote authenticated administrators to inject arbitrary web script or HTML via unspecified vectors, as demonstrated by the twitgetconsumerkey parameter to...

CVE-2014-6312: Improper Neutralization of Input During Web Page Generation

Cross-site request forgery CSRF vulnerability in the Login Widget With Shortcode login-sidebar-widget plugin before 3.2.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the customstyleafo paramete...

PT-2014-7146

Name of the Vulnerable Software and Affected Versions Login Widget With Shortcode login-sidebar-widget plugin versions prior to 3.2.1 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site...

CVE-2014-5389: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in content-audit-schedule.php in the Content Audit plugin before 1.6.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the "Audited content types" option in the content-audit page to wp-admin/options-general.php...

PT-2014-6446

Name of the Vulnerable Software and Affected Versions Content Audit plugin versions prior to 1.6.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved by exploiting the "Audited content types" option in the content-audit page, which is accessed throug...

CVE-2014-5089

SQL injection vulnerability in admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary SQL commands via the log parameter...

Sql injection

SQL injection vulnerability in admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary SQL commands via the log parameter...

CVE-2014-5089

Status2k Server Monitoring Software (Status2K) is affected by CVE-2014-5089 due to an SQL injection in admin/options/logs.php where the log parameter can be exploited by remote authenticated administrators to execute arbitrary SQL commands. This is supported by multiple sources (NVD entry CVE-201...

PT-2014-6273

Name of the Vulnerable Software and Affected Versions Status2k affected versions not specified Description The issue allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the Location field in Add Logs in the Admin Panel. This is possible due to a la...

PT-2014-6272

Name of the Vulnerable Software and Affected Versions Status2k affected versions not specified Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved by exploiting a SQL injection vulnerability in the admin/options/logs.php file via th...

CVE-2014-5090: Improper Control of Generation of Code

admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary commands via shell metacharacters in the Location field in Add Logs in the Admin Panel...

CVE-2014-5089: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/options/logs.php in Status2k allows remote authenticated administrators to execute arbitrary SQL commands via the log parameter...