2064 matches found
WordPress OdiHost Newsletter plugin <= 1.0 - SQL Injection Vulnerability
No description provided by source. Exploit Title: WordPress OdiHost Newsletter plugin = 1.0 SQL Injection Vulnerability Date: 2011-08-17 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link: http://downloads.wordpress.org/plugin/odihost-newsletter-plugin.zip Version: 1.0...
STRATO Newsletter Manager Directory Traversal
No description provided by source. STRATO Newsletter Manager is vulnerable against Directory Traversal Vendor: www.strato-cgi.de Google Dork: inurl:newsletter.php.cgi Exploit:...
ContaoCMS (aka TYPOlight) <= 2.11 CSRF (Delete Admin - Delete Article)
No description provided by source. +--------------------------------------------------------------------------------------------------------------------------------+ Exploit Title : ContaoCMS aka TYPOlight = 2.11 CSRF Delete Admin- Delete Article Date : 25-02-2012 Author : Ivano Binetti...
WordPress Plugin ENL NewsLetter - wp-adminadmin.php SQL Injection
WordPress Plugin ENL NewsLetter - wp-adminadmin.php SQL Injection source: https://www.securityfocus.com/bid/68558/info ENL Newsletter plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue t...
WordPress Plugin ENL NewsLetter - '/wp-admin/admin.php' SQL Injection
source: https://www.securityfocus.com/bid/68558/info ENL Newsletter plugin for WordPress is prone to an SQL-injection vulnerability because it fails to sufficiently sanitize user-supplied input. An attacker can exploit this issue to compromise the application, access or modify data, or exploit...
CVE-2014-2922
The getObjectByToken function in Newsletter.php in the PimcoreToolNewsletter module in pimcore 1.4.9 through 2.1.0 does not properly handle an object obtained by unserializing a pathname, which allows remote attackers to conduct PHP object injection attacks and delete arbitrary files via vectors...
PT-2014-4958
Name of the Vulnerable Software and Affected Versions pimcore versions 1.4.9 through 2.1.0 Description The issue concerns the getObjectByToken function in Newsletter.php within the Pimcore Tool Newsletter module. It fails to properly handle an object obtained by unserializing a pathname, allowing...
PT-2014-4957
Name of the Vulnerable Software and Affected Versions pimcore versions 1.4.9 through 2.0.0 Description The issue concerns the getObjectByToken function in the Pimcore Tool Newsletter module, which does not properly handle objects obtained from unserializing Lucene search data. This allows remote...
Pimcore "Pimcore_Tool_Newsletter::getObjectByToken()" PHP对象注入漏洞
Pimcore是一个纯粹的基于 Zend Framework, 使用PHP 5编写的面向对象的系统。 Pimcore /lib/Pimcore/Tool/Newsletter.php中的"PimcoreToolNewsletter::getObjectByToken"方法不正确过滤用户提交的输入，允许攻击者提交特制的序列化对象删除任意文件。 0 Pimcore 2.x Pimcore 2.2.0版本已修复该漏洞，建议用户下载使用： http://www.pimcore.org...
CVE-2012-6627
Cross-site scripting XSS vulnerability in admin/testmail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter...
CVE-2012-6628
Multiple cross-site scripting XSS vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 xyzemcampName to admin/createcampaign.php or 2 admin/editcampaign.php, 3 xyzememail parameter to admin/editemail.ph...
CVE-2012-6629
Multiple cross-site request forgery CSRF vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change an email address or 2 conduct script insertion attacks. NOTE: the provenance o...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 xyzemcampName to admin/createcampaign.php or 2 admin/editcampaign.php, 3 xyzememail parameter to admin/editemail.ph...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change an email address or 2 conduct script insertion attacks. NOTE: the provenance o...
Cross site scripting
Cross-site scripting XSS vulnerability in admin/testmail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter...
CVE-2012-6628
CVE-2012-6628 reports multiple cross-site scripting (XSS) vulnerabilities in the WordPress Newsletter Manager plugin before 1.0.2. The issue allows remote attackers to inject arbitrary script/HTML via one of five vectors: (1) xyz_em_campName to admin/create_campaign.php, (2) xyz_em_campName to ad...
CVE-2012-6629
CVE-2012-6629 pertains to the WordPress Newsletter Manager plugin (versions 1.0.2 and earlier). The vulnerability set consists of CSRF flaws that allow remote attackers to hijack administrator sessions for actions such as changing an email address or performing script insertion attacks. Impact is...
CVE-2012-6628
Multiple cross-site scripting XSS vulnerabilities in the Newsletter Manager plugin before 1.0.2 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 xyzemcampName to admin/createcampaign.php or 2 admin/editcampaign.php, 3 xyzememail parameter to admin/editemail.ph...
CVE-2012-6627
Cross-site scripting XSS vulnerability in admin/testmail.php in the Newsletter Manager plugin 1.0.2 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter...
CVE-2012-6627
The CVE-2012-6627 issue concerns the Newsletter Manager WordPress plugin (versions 1.0.2 and earlier) where an XSS vulnerability exists in admin/test_mail.php via the id parameter. The affected component is the Newsletter Manager plugin for WordPress, with the root cause being improper sanitizati...