PT-2014-5592

Name of the Vulnerable Software and Affected Versions Cakifo theme versions 1.x before 1.6.2 for WordPress Description A cross-site scripting XSS issue allows remote authenticated users to inject arbitrary web script or HTML via crafted Exif data. Recommendations For Cakifo theme versions 1.x...

CVE-2014-3903: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Cakifo theme 1.x before 1.6.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via crafted Exif data...

CVE-2014-1980

Cross-site scripting XSS vulnerability in include/functionsmetadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin...

CVE-2014-1980

Cross-site scripting XSS vulnerability in include/functionsmetadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin...

Cross site scripting

Cross-site scripting XSS vulnerability in include/functionsmetadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin...

CVE-2014-1980

Cross-site scripting XSS vulnerability in include/functionsmetadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin...

CVE-2014-1980

Cross-site scripting XSS vulnerability in include/functionsmetadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin...

CVE-2014-1980

The CVE-2014-1980 issue is a cross-site scripting (XSS) vulnerability in Piwigo prior to version 2.4.6. It affects the code path include/functions_metadata.inc.php when processing IPTC Exif metadata via the Community plugin during image uploads. Remote attackers could inject arbitrary web script ...

PT-2014-4402

Name of the Vulnerable Software and Affected Versions Piwigo versions prior to 2.4.6 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to...

CVE-2014-1980: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in include/functionsmetadata.inc.php in Piwigo before 2.4.6 allows remote attackers to inject arbitrary web script or HTML via the Make field in IPTC Exif metadata within an image uploaded to the Community plugin...

Lazyest Gallery <= 1.1.20 - EXIF Script Insertion

The Lazyest Gallery WordPress plugin was affected by an EXIF Script Insertion security vulnerability...

Discuz NT3.1 版本可利用恶意图片进行XSS攻击

简要描述： 好吧，纯粹业余的，在使用公司内部论坛的时候无意间发现的，百度谷歌都没搜到类似的报告，姑且认为这个漏洞没过时吧…… 详细说明： 程序解析图片Exif信息所致。 首先，图片详细信息我们可以自己编辑，如图： 然后，回帖添加附件的时候只要不插入附件就可以让页面读取图片exif信息并运行脚本，就像这样…… 漏洞证明：...

deV!Lz Clanportal [DZCP] <= 1.3.6 - Arbitrary File Upload Vulnerability

No description provided by source. S Y N O P S I S / =================' - access: remote severity: high - deV!Lz Clanportal allows nearly arbitrary files to be uploaded and stored on the server's filesystem, which enables anyone, even without a user account, to upload PHP code and execute it,...

4Images <= 1.7.1 (Local Inclusion) Remote Code Execution Exploit

No description provided by source. ?php ----4images171inclxpl.php 6.45 26/02/2006 4Images = 1.7.1 remote commands execution through arbitrary local inclusion coded by rgod site: http://retrogod.altervista.org - this works regardless of magicquotesgpc settings Sun-Tzu: Having doomed spies, doing...

Wifi Photo Transfer 2.1 & 1.1 PRO - Multiple Vulnerabilities

No description provided by source. Title: ====== Wifi Photo Transfer 2.1 & 1.1 PRO - Multiple Vulnerabilities Date: ===== 2013-04-21 References: =========== http://www.vulnerability-lab.com/getcontent.php?id=932 VL-ID: ===== 932 Common Vulnerability Scoring System:...

WordPress Cakifo Theme <= 1.6.1 - XSS

Because of this vulnerability, authenticated users can inject arbitrary web script or HTML via crafted Exif data. Solution Update the theme...

WordPress HK Exif Tags插件EXIF标签脚本注入漏洞

WordPress是一款内容管理系统。 由于通过EXIF标签传递的输入在被使用前没有正确过滤，攻击者可以利用漏洞在受影响站点上下文的用户浏览器会话中注入并执行任意HTML和脚本代码。 0 WordPress HK Exif Tags Plugin 1.x WordPress HK Exif Tags 1.12版本以修复此漏洞，建议用户下载使用： http://wordpress.org/plugins/hk-exif-tags/changelog/...

CVE-2014-2333

Cross-site scripting XSS vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information...

Cross site scripting

Cross-site scripting XSS vulnerability in the Lazyest Gallery plugin before 1.1.21 for WordPress allows remote attackers to inject arbitrary web script or HTML via an EXIF tag. NOTE: some of these details are obtained from third party information...

CVE-2014-2333

CVE-2014-2333 affects the WordPress plugin Lazyest Gallery (pre-1.1.21). The vulnerability is a stored/reflected XSS via an EXIF tag in the image handling code, enabling remote attackers to inject arbitrary script or HTML. Public details come from NVD/NVD-related feeds and WPVulnDB entries; explo...