PT-2020-20618

Name of the Vulnerable Software and Affected Versions Appointment Booking Calendar plugin versions prior to 1.3.35 Description The issue allows user input in fields such as Description or Name in any booking form to be any formula. This input could then be exported via the Bookings list tab in...

Easy2Pilot 7 - Cross-Site Request Forgery (Add User) Vulnerability

Exploit for php platform in category web applications Exploit Title: Easy2Pilot 7 - Cross-Site Request Forgery Add User Author: indoushka Tested on: windows 10 Français V.Pro / browser : Mozilla firefox 69.032-bit Vendor: http://easy2pilot-v7.com/ CVE: N/A poc : + Dorking İn Google Or Other Searc...

WordPress Contact-Form-7 5.1.6 Cross Site Scripting

Title : word press plugin contact-form-7 5.1.6 - Cross-Site Scripting - Author : mehran feizi - Vendor : https://wordpress.org/plugins/contact-form-7/ - Tested on : Windows - Category : Webapps - Date : 2020-02-17...

PT-2020-7816

Name of the Vulnerable Software and Affected Versions: Huge-IT Slider slider-image plugin versions prior to 2.7.0 Description: The issue allows remote administrators to execute arbitrary SQL commands. This can be achieved via the removeslide parameter in a popup posts or edit cat action in the...

CVE-2015-2062: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the Huge-IT Slider slider-image plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popupposts or editcat action in the slidershugeitslider page to wp-admin/admin.php...

PT-2020-20254

Name of the Vulnerable Software and Affected Versions BestWebSoft Htaccess plugin versions prior to 1.8.2 Description The issue allows for Cross-Site Request Forgery CSRF attacks due to incorrect validation of the htccss nonce name flag, which is supposed to pass a nonce to WordPress for anti-CSR...

CVE-2020-8658: Cross-Site Request Forgery (CSRF)

The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...

Elementor Page Builder < 2.8.5 - Authenticated Reflected XSS

The Elementor Website Builder WordPress plugin was affected by an Authenticated Reflected XSS security vulnerability. /wp-admin/admin.php?page=elementor-system-info&lndan%22%3e%3cscript%0csrc%3d//0x7f000001%3e%3c/script%3e=1...

CVE-2011-3611

A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12...

CVE-2011-3611

A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12...

CVE-2011-3611

A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12...

PT-2020-7122

Name of the Vulnerable Software and Affected Versions UseBB versions prior to 1.0.12 Description A File Inclusion issue exists in the act parameter to admin.php in UseBB. Recommendations For versions prior to 1.0.12, update to version 1.0.12 or later to resolve the issue. As a temporary workaroun...

CVE-2011-3611: Improper Input Validation

A File Inclusion vulnerability exists in act parameter to admin.php in UseBB before 1.0.12...

PT-2020-19263

Name of the Vulnerable Software and Affected Versions marketo-forms-and-tracking plugin versions prior to 1.0.3 Description The issue allows for Cross-Site Request Forgery CSRF with resultant Cross-Site Scripting XSS in the "wp-admin/admin.php?page=marketo fat" API endpoint. Recommendations For...

CVE-2020-6849: Cross-Site Request Forgery (CSRF)

The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketofat CSRF with resultant XSS...

CVE-2020-7047: Improper Privilege Management

The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability with a simple wp-admin/admin.php?db-reset-tables=users request to escalate their privileges to administrator while dropping all other users from the table...

PT-2020-19355

Name of the Vulnerable Software and Affected Versions WP Database Reset versions 3.1 and earlier Description The issue allows any authenticated user with minimal permissions to escalate their privileges to administrator by sending a request to the "wp-admin/admin.php?db-reset-tables=users" API...

ZenPhoto Cross-Site Request Forgery Vulnerability

ZenPhoto is a free content management system for photo libraries. The system manages images and supports multimedia such as audio and video. A cross-site request forgery vulnerability exists in the admin.php file in Zenphoto versions prior to 1.4.9. The vulnerability stems from the WEB applicatio...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in admin.php in Zenphoto before 1.4.9 allows remote attackers to hijack the authentication of admin users for requests that may cause a denial of service resource consumption...

CVE-2015-5595

Zenphoto is affected by a CSRF in admin.php prior to version 1.4.9 that could allow an attacker to hijack an admin’s session and trigger requests leading to resource consumption (denial of service). Public sources confirm the vulnerability exists in Zenphoto