WordPress Simple Ads Manager 2.5.94 / 2.5.96 SQL Injection

Vulnerability title: Wordpress plugin Simple Ads Manager - Multiple SQL Injection Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 and 2.5.96 Download link: https://wordpress.org/plugins/simple-ads-manager/ CV...

Wordpress Simple Ads Manager Plugin - Multiple SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability title: Wordpress plugin Simple Ads Manager - SQL Injection Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 and 2.5.96 Download link:...

SP Project & Document Manager <= 2.5.3 - Blind SQL Injection

The SP Project & Document Manager WordPress plugin was affected by a Blind SQL Injection security vulnerability. PoC http://www.example.com/wp-content/plugins/sp-client-document-manager/ajax.php?function=thumbnails=SQLi...

WordPress Plugin SP Project Document Manager 2.5.3 - Blind SQL Injection

WordPress Plugin SP Project Document Manager 2.5.3 - Blind SQL Injection Exploit Title: WordPress SP Project & Document Manager 2.5.3 Blind SQL Injection Google Dork: inurl:wp-content/plugins/sp-client-document-manager Date: 2015-03-04 Exploit Author: catsecurity Vendor Homepage:...

Qibo Blog 1.0 /blog/ajax.php SQL注入漏洞

No description provided by source...

Wpshop - eCommerce <= 1.3.9.5 - Arbitrary File Upload

The script 'includes/ajax.php' allows execution of various actions by anonymous users. The action name is provided in the 'elementCode' parameter. One of these actions is named 'ajaxUpload'. This function allows for upload of arbitrary files, due to lack of sanitation of user input...

maccms8.0 注入漏洞

简要描述： maccms8.0 注入漏洞 详细说明： 漏洞代码在 inc/ajax.php 首先通过封装的be方法取得tab参数 直接把tab参数带入到了查询当中，因为注入点不在双引号内部，所以可以直接注入。 这里需要一点小技巧让SQL语句不报错。payload如下： URL： http://10.1.157.64/maccms8mfb/inc/ajax.php ?ac=hits &tab=user,select1 as hits,2 as dayhits,3 as weekhits , 4 as monthhits ,5 as hitstimefrom dualtemp where 2...

Sql injection

SQL injection vulnerability in Spider Event Calendar 1.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the catid parameter in a spiderbigcalendarmonth action to wp-admin/admin-ajax.php...

Sql injection

SQL injection vulnerability in the ajaxsurvey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the surveyid parameter in an ajaxsurvey action to wp-admin/admin-ajax.php...

CVE-2015-2090

SQL injection vulnerability in the ajaxsurvey function in settings.php in the WordPress Survey and Poll plugin 1.1.7 for Wordpress allows remote attackers to execute arbitrary SQL commands via the surveyid parameter in an ajaxsurvey action to wp-admin/admin-ajax.php...

Sql injection

SQL injection vulnerability in videogalleryrss.php in the Apptha WordPress Video Gallery contus-video-gallery plugin before 2.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php...

Quasar Theme Rock Form Builder plugin - Privilege Escalation

The Rock Form Builder plugin 1.0 is used within the Quasar WooCommerce theme 1.9.1. Authenticated users can modify WordPress settings which can lead to full site compromise. It's unclear which exact version of the rock-form-builder fixed the issue, but it was something in between 1.0 and 2.5, so...

WeBid 1.1.1 Unrestricted File Upload

?php / ,--^----------,--------,-----,-------^--, | ||||||||| --------' | O .. CWH Underground Hacking Team .. +---------------------------^----------| ,-------, | / XXXXXX /| / / XXXXXX / \ / / XXXXXX /\ / XXXXXX / / XXXXXX / ------' Exploit Title : WeBid 1.1.1 Unrestricted File Upload Exploit...

WonderPlugin Audio Player 2.0 Blind SQL Injection and XSS Vulnerabilities

Exploit for php platform in category web applications Exploit Title: WonderPlugin Audio Player 2.0 Blind SQL Injection and XSS Date: 20-01-2015 Software Link: http://www.wonderplugin.com/wordpress-audio-player/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website:...

WordPress Plugin Webdorado Spider Event Calendar 1.4.9 - SQL Injection

. Exploit Title: WordPress: Webdorado Spider Event Calendar = 1.4.9 SQL Injection Date: 2015-02-12 Exploit Author: Mateusz Lach Vendor Homepage: https://www.facebook.com/WebDorado or http://www.webdorado.com Software Link: https://downloads.wordpress.org/plugin/spider-event-calendar.1.4.9.zip...

CVE-2015-1582

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...

CVE-2015-1579

CVE-2015-1579 describes a directory traversal in the WordPress Slider Revolution plugin (revslider) prior to version 4.2. An attacker can cause read of arbitrary server files by supplying a .. sequence in the img parameter to the revslider_show_image action via wp-admin/admin-ajax.php. This affec...

Wordpress Video Gallery <= 2.7 - SQL Injection

The contus-video-gallery WordPress plugin was affected by a SQL Injection security vulnerability. http://example.com/wp-admin/admin-ajax.php?action=rss&type=video&vid=SQLi...

Sql injection

Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow 1 remote attackers to execute arbitrary SQL commands via the device ID REST parameter PATHINFO to /ajax.php or 2 remote authenticated users to execute arbitrary SQL commands via the order parameter to index.php...