Cross site request forgery (csrf)

admin.php?page=notificationbymail in Piwigo 2.9.5 has XSS via the nbmsendhtmlmail, nbmsendmailas, nbmsenddetailedcontent, nbmcomplementarymailcontent, nbmsendrecentpostdates, or paramsubmit parameter. This is exploitable via CSRF...

CVE-2019-13363

CVE-2019-13363 affects Piwigo 2.9.5. The vulnerability is a Cross‑Site Scripting (XSS) in the admin.php?page=notification_by_mail endpoint, exploitable via parameters such as nbm_send_html_mail, nbm_send_mail_as, nbm_send_detailed_content, nbm_complementary_mail_content, nbm_send_recent_post_date...

CVE-2019-13363

admin.php?page=notificationbymail in Piwigo 2.9.5 has XSS via the nbmsendhtmlmail, nbmsendmailas, nbmsenddetailedcontent, nbmcomplementarymailcontent, nbmsendrecentpostdates, or paramsubmit parameter. This is exploitable via CSRF...

CVE-2019-13363

admin.php?page=notificationbymail in Piwigo 2.9.5 has XSS via the nbmsendhtmlmail, nbmsendmailas, nbmsenddetailedcontent, nbmcomplementarymailcontent, nbmsendrecentpostdates, or paramsubmit parameter. This is exploitable via CSRF...

CVE-2017-18614

The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter...

Design/Logic Flaw

The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter...

Sql injection

The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter...

CVE-2017-18614

The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter...

CVE-2017-18614

CVE-2017-18614 affects the WordPress plugin kama-clic-counter (v3.4.9) . Multiple connected sources confirm a SQL injection vulnerability exposed via the plugin’s admin.php, specifically the order parameter . The root cause is described as a lack of validation of externally entered SQL statements...

PT-2019-8545

Name of the Vulnerable Software and Affected Versions kama-clic-counter plugin version 3.4.9 Description The issue concerns SQL injection via the order parameter in the "admin.php" endpoint. This allows for potential exploitation by injecting malicious SQL code. Recommendations For...

PT-2019-7745

Name of the Vulnerable Software and Affected Versions quotes-collection plugin versions prior to 2.0.6 Description The issue concerns a Cross-Site Scripting XSS vulnerability. It affects the quotes-collection plugin for WordPress, specifically via the wp-admin/admin.php?page=quotes-collection pag...

CVE-2019-13364: Improper Neutralization of Input During Web Page Generation

admin.php?page=accountbilling in Piwigo 2.9.5 has XSS via the vatnumber, billingname, company, or billingaddress parameter. This is exploitable via CSRF...

CVE-2019-12516: Improper Neutralization of Special Elements used in an SQL Command

The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI...

CVE-2016-10952: Improper Neutralization of Input During Web Page Generation

The quotes-collection plugin before 2.0.6 for WordPress has XSS via the wp-admin/admin.php?page=quotes-collection page parameter...

CVE-2017-18613: Improper Neutralization of Input During Web Page Generation

The trust-form plugin 2.0 for WordPress has XSS via the wp-admin/admin.php?page=trust-form-edit page parameter...

CVE-2017-18614: Improper Neutralization of Special Elements used in an SQL Command

The kama-clic-counter plugin 3.4.9 for WordPress has SQL injection via the admin.php order parameter...

CVE-2019-13363: Improper Neutralization of Input During Web Page Generation

admin.php?page=notificationbymail in Piwigo 2.9.5 has XSS via the nbmsendhtmlmail, nbmsendmailas, nbmsenddetailedcontent, nbmcomplementarymailcontent, nbmsendrecentpostdates, or paramsubmit parameter. This is exploitable via CSRF...

PT-2019-8544

Name of the Vulnerable Software and Affected Versions trust-form plugin version 2.0 Description The issue concerns a problem with the trust-form plugin for WordPress, where there is a potential for XSS via the "page" parameter in the wp-admin/admin.php page, specifically when editing trust forms...

PT-2019-8528

Name of the Vulnerable Software and Affected Versions jtrt-responsive-tables plugin versions prior to 4.1.2 Description The issue concerns SQL Injection via the tableId parameter in the admin/class-jtrt-responsive-tables-admin.php file. This allows for potential exploitation. No information is...

PT-2019-12837

Name of the Vulnerable Software and Affected Versions SlickQuiz plugin versions prior to 1.3.7.2 Description The issue allows SQL Injection by Subscriber users. This can be demonstrated through specific API endpoints such as "/wp-admin/admin.php?page=slickquiz-scores&id=",...