CVE-2014-1888

Cross-site scripting XSS vulnerability in the BuddyPress plugin before 1.9.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the name field to groups/create/step/group-details. NOTE: this can be exploited without authentication by leveraging CVE-2014-188...

Wordpress Buddypress插件'name'字段HTML注入漏洞

Bugtraq ID:65555 CVE ID:CVE-2014-1888 WordPress是一种使用PHP语言开发的博客平台，用户可以在支持PHP和MySQL数据库的服务器上架设自己的网志。 Wordpress plugin Buddypress插件不正确过滤'name'字段数据，允许远程攻击者利用漏洞注入恶意脚本或HTML代码，当恶意数据被查看时，可获取敏感信息或劫持用户会话。 0 Wordpress plugin Buddypress = 1.9.1 厂商补丁： Wordpress ----- Wordpress plugin Buddypress...

WordPress Buddypress 1.9.1 Cross Site Scripting Vulnerability

WordPress Buddypress plugin versions 1.9.1 and below suffer from a persistent cross site scripting vulnerability. Vulnerability: Wordpress plugin Buddypress = 1.9.1 stored xss Date: 13/02/2014 Author: Pietro Oliva Vendor Homepage: http://buddypress.org Software Link:...

WordPress Buddypress 1.9.1 Privilege Escalation Vulnerability

WordPress Buddypress plugin versions 1.9.1 and below suffer from a privilege escalation vulnerability. Vulnerability: Wordpress plugin Buddypress 2 Visit the url http://example.com/groups/create/step/group-details/ 3 Enjoy the power 0day.today 2018-04-01...

WordPress Buddypress 1.9.1 Cross Site Scripting

Vulnerability: Wordpress plugin Buddypress = 1.9.1 stored xss Date: 13/02/2014 Author: Pietro Oliva Vendor Homepage: http://buddypress.org Software Link: http://downloads.wordpress.org/plugin/buddypress.1.9.1.zip Version: 1.9.1 CVE : CVE-2014-1888 Responsibly disclosed and patched in version 1.9....

WordPress Buddypress 1.9.1 Privilege Escalation

Vulnerability: Wordpress plugin Buddypress 2 Visit the url http://example.com/groups/create/step/group-details/ 3 Enjoy the power -Pietro Oliva-...

WordPress Plugin BuddyPress 1.9.1 - Privilege Escalation

WordPress Plugin BuddyPress 1.9.1 - Privilege Escalation Exploit Title: Wordpress plugin Buddypress 2 Visit the url http://example.com/groups/create/step/group-details/ 3 Enjoy the power...

WordPress Buddypress Plugin 1.9.1 - Privilege Escalation

Buddypress plugin is prone tu vulnerability that allows an attacker to take control of every group change name, description, avatar and settings. Solution Upgrade the plugin...

WordPress Plugin BuddyPress 1.9.1 - Privilege Escalation

Exploit Title: Wordpress plugin Buddypress 2 Visit the url http://example.com/groups/create/step/group-details/ 3 Enjoy the power...

WordPress BuddyPress Plugin <= 1.9.1 - XSS

Because of this vulnerability, authenticated users can inject arbitrary web script or HTML via the name field to groups/create/step/group-details. Solution Update the plugin...

CVE-2013-4944

Cross-site scripting XSS vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress, when the "Friend Connections" component is enabled, allows remote attackers to inject arbitrary web script or HTML via the friendshiprequestmessage parameter to...

Cross site scripting

Cross-site scripting XSS vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress, when the "Friend Connections" component is enabled, allows remote attackers to inject arbitrary web script or HTML via the friendshiprequestmessage parameter to...

CVE-2013-4944

The CVE-2013-4944 issue affects the WordPress plugin BuddyPress Extended Friendship Request (versions before 1.0.2). When the Friend Connections component is enabled, an XSS flaw exists in the friendship_request_message parameter passed to wp-admin/admin-ajax.php, enabling remote script/HTML inje...

CVE-2013-4944

Cross-site scripting XSS vulnerability in the BuddyPress Extended Friendship Request plugin before 1.0.2 for WordPress, when the "Friend Connections" component is enabled, allows remote attackers to inject arbitrary web script or HTML via the friendshiprequestmessage parameter to...

WordPress BuddyPress Extended Friendship Request Plugin <= 1.0.1 - XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "friendshiprequestmessage" parameter. Solution Update the plugin...

CS and XSS vulnerabilities in BuddyPress for WordPress

Hello 3APA3A! I want to warn you about multiple security vulnerabilities in plugin BuddyPress for WordPress. I've disclosed vulnerabilities in JW Player in June and August including in commercial version JW Player Pro and disclosed vulnerabilities in Rokbox in December. And BuddyPress uses this...

XSS and CS vulnerabilities in BuddyPress for WordPress

Hello 3APA3A! I want to warn you about multiple security vulnerabilities in plugin BuddyPress for WordPress. I've disclosed vulnerabilities in JW Player in June and August including in commercial version JW Player Pro and disclosed vulnerabilities in Rokbox in December. And BuddyPress uses this...

WordPress BuddyPress Cross Site Scripting / Content Spoofing

Hello list! I want to warn you about multiple security vulnerabilities in plugin BuddyPress for WordPress. I've disclosed vulnerabilities in JW Player in June and August including in commercial version JW Player Pro and disclosed vulnerabilities in Rokbox in December. And BuddyPress uses this...

CVE-2012-2109

SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activitywidgetfilter action...

Sql injection

SQL injection vulnerability in wp-load.php in the BuddyPress plugin 1.5.x before 1.5.5 of WordPress allows remote attackers to execute arbitrary SQL commands via the page parameter in an activitywidgetfilter action...