WordPress Plugin WP Mobile Edition 2.7 - Remote File Disclosure

Exploit Title: Wordpress Plugin 'WP Mobile Edition' Remote File Disclosure Vulnerability Date: April 11, 2015 Exploit Author: @LookHin Khwanchai Kaewyos Google Dork: inurl:?fdxswitcher=mobile Vendor Homepage: https://wordpress.org/plugins/wp-mobile-edition/ Software Link:...

WordPress WP Mobile Edition Plugin 2.7 - Remote File Disclosure

WP Mobile Edition plugin's "get" parameter is prone to a remote file disclosure vulnerability via "themes/mTheme-Unus/css/css.php". Solution Upgrade the plugin...

WP Mobile Edition <= 2.2.7 - Remote File Disclosure

The plugin is not filtering data in GET parameter 'files' in file 'themes/mTheme-Unus/css/css.php' http://www.example.com/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php...

WordPress Plugin WP Mobile Edition 2.7 - Remote File Disclosure

WordPress Plugin WP Mobile Edition 2.7 - Remote File Disclosure Exploit Title: Wordpress Plugin 'WP Mobile Edition' Remote File Disclosure Vulnerability Date: April 11, 2015 Exploit Author: @LookHin Khwanchai Kaewyos Google Dork: inurl:?fdxswitcher=mobile Vendor Homepage:...

Code injection

The Mobile Edition of TransWARE Active! mail 2003 build 2003.0139.0871 and earlier, and possibly other versions before 2003.0139.0911, does not remove the session ID in a Referer URL, which allows remote attackers to hijack web sessions via vectors such as an email with an embedded URL...

CVE-2009-4353

CVE-2009-4353 affects Active! mail 2003 Mobile Edition (build 2003.0139.0871 and earlier; possibly before 2003.0139.0911). The issue is that the application does not remove the session ID from a Referer URL, enabling a remote attacker to hijack web sessions via vectors such as an email containing...