WordPress InfiniteWP Admin Panel 2.8.0 Authorization Bypass

------------------------------------------------------------------------ Authorization bypass in InfiniteWP Admin Panel ------------------------------------------------------------------------ Sipke Mellema, July 2016 ------------------------------------------------------------------------ Abstra...

WordPress InfiniteWP Admin Panel 2.8.0 Command Injection

------------------------------------------------------------------------ Command injection in InfiniteWP Admin Panel ------------------------------------------------------------------------ Sipke Mellema, July 2016 ------------------------------------------------------------------------ Abstract...

InfiniteWP Admin Panel 2.8.0 - authorization bypass

InfiniteWP Admin Panel version 2.8.0 has vulnerable authentication method. Solution Update InfiniteWP Admin Panel plugin at least to 2.9.0 version...

WordPress InfiniteWP Client Plugin <= 1.3.14 - Unspecified Critical

There is an unknown issue in this plugin. Solution Update the plugin...

InfiniteWP Client <= 1.3.14 - Unspecified Critical

The InfiniteWP Client WordPress plugin was affected by an Unspecified Critical security vulnerability...

CVE-2014-9520

SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter...

CVE-2014-9519

SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter...

Unrestricted file upload

Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the...

Sql injection

SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter...

CVE-2014-9519

CVE-2014-9519 describes an SQL injection in the InfiniteWP Admin Panel, specifically in login.php, exploited through the email parameter to allow remote attackers to execute arbitrary SQL commands. Affected software is the InfiniteWP Admin Panel prior to version 2.4.3. The NVD entry assigns a bas...

CVE-2014-9521

CVE-2014-9521 affects InfiniteWP Admin Panel (older than 2.4.4). The vulnerability is an unrestricted file upload in uploadScript.php when the allWPFiles parameter is set, enabling remote code execution by uploading a file with a double extension (e.g., .php.swp) and then invoking it via a direct...

CVE-2014-9519

SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter...

CVE-2014-9520

SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter...

CVE-2014-9521

Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the...

CVE-2014-9520

CVE-2014-9520 affects InfiniteWP Admin Panel prior to 2.4.4, with a SQL injection in execute.php via the historyID parameter that could allow remote attackers to execute arbitrary SQL commands. This is the stated vulnerability in multiple sources; no exploit details are provided in the documents....

CVE-2014-9521: Improper Control of Generation of Code

Unrestricted file upload vulnerability in uploadScript.php in InfiniteWP Admin Panel before 2.4.4, when the allWPFiles query parameter is set, allows remote attackers to execute arbitrary code by uploading a file with a double extension, then accessing it via a direct request to the file in the...

PT-2015-4260

Name of the Vulnerable Software and Affected Versions InfiniteWP Admin Panel versions prior to 2.4.3 Description The issue allows remote attackers to execute arbitrary SQL commands via the email parameter in the login.php file. Recommendations For versions prior to 2.4.3, update to version 2.4.3 ...

CVE-2014-9520: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in execute.php in InfiniteWP Admin Panel before 2.4.4 allows remote attackers to execute arbitrary SQL commands via the historyID parameter...

CVE-2014-9519: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in login.php in InfiniteWP Admin Panel before 2.4.3 allows remote attackers to execute arbitrary SQL commands via the email parameter...

PT-2015-4262

Name of the Vulnerable Software and Affected Versions InfiniteWP Admin Panel versions prior to 2.4.4 Description The issue allows remote attackers to execute arbitrary code by uploading a file with a double extension and then accessing it via a direct request to the file in the uploads directory...