WordPress和WordPress 插件 SQL注入漏洞

WordPress is the Wordpress Foundation's set of blogging platform developed using the PHP language . The platform supports PHP and MySQL servers to set up a personal blog site.WordPress plugin is a WordPress open source application plug-ins. WordPress BSK PDF Manager plugin version 3.1.2 before th...

WordPress BSK PDF Manager plugin <= 3.1.1 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by JrXnm in WordPress BSK PDF Manager plugin versions = 3.1.1. Solution Update the WordPress BSK PDF Manager plugin to the latest available version at least 3.1.2...

BSK PDF Manager < 3.1.2 - Admin+ SQL Injection

The plugin does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue PoC With at least one BSK PDF Category: https://example.com/wp-admin/admin.php?page=bsk-pdf-manager=and+sleep5...

WordPress BSK PDF Manager plugin <= 3.1.1 - SQL Injection (SQLi) vulnerability

SQL Injection SQLi vulnerability discovered by JrXnm in WordPress BSK PDF Manager plugin versions = 3.1.1. Solution Update the WordPress BSK PDF Manager plugin to the latest available version at least 3.1.2...

BSK PDF Manager < 3.1.2 - Admin+ SQL Injection

The plugin does not validate and escape the orderby and order parameters before using them in a SQL statement, leading to a SQL injection issue With at least one BSK PDF Category: https://example.com/wp-admin/admin.php?page=bsk-pdf-manager&order=and+sleep5...

I, Librarian PDF Manager Cross-Site Scripting Vulnerability

I, Librarian PDF Manager is an online service that will organize your collection of PDF and office documents. A cross-site scripting vulnerability exists in I, Librarian PDF Manager. An attacker could exploit this vulnerability to cause an information disclosure...

I, Librarian PDF Manager Command Injection Vulnerability

I, Librarian PDF Manager is an online service that will organize your collection of PDF and office documents. I, Librarian PDF Manager suffers from a command injection vulnerability. An attacker can exploit this vulnerability to inject arbitrary HTML...

I, Librarian PDF Manager Directory Enumeration Vulnerability

I, Librarian PDF Manager is an online service that will organize your collection of PDF and office documents. A directory enumeration vulnerability exists in I, Librarian PDF Manager, which can be exploited by an attacker to enumerate files in a web server directory...

I_ Librarian 4.6/4.7 - Command Injection / Server Side Request Forgery / Directory Enumeration / Cross-Site Scripting

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: I, Librarian PDF manager vulnerable version: =4.6 & 4.7 fixed version: 4.8 CVE number: - impact: Critical homepage:...

I_ Librarian 4.64.7 - Command Injection Server Side Request Forgery Directory Enumeration Cross-Site Scripting

I Librarian 4.64.7 - Command Injection Server Side Request Forgery Directory Enumeration Cross-Site Scripting SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: I, Librarian PDF manager...

I, Librarian PDF Manager 4.6 / 4.7 Command Injection / SSRF / Enumeration

SEC Consult Vulnerability Lab Security Advisory ======================================================================= title: Multiple vulnerabilities product: I, Librarian PDF manager vulnerable version: =4.6 & 4.7 fixed version: 4.8 CVE number: - impact: Critical homepage:...

Librarian PDF Manager 4.6 / 4.7 Command Injection / SSRF / Enumeration

I, Librarian PDF Manager versions 4.6 and below along with version 4.7 suffer from command injection, server-side request forgery, cross site scripting, and directory enumeration vulnerabilities. ======================================================================= title: Multiple vulnerabiliti...

WordPress BSK PDF Manager Plugin <= 1.3 - Cross Site Scripting

This plugin is prone to a cross site scripting in wp-admin/admin.php multiple parameter. Solution Upgrade the plugin...

BSK PDF Manager < 1.5 - Multiple Authenticated SQL Injections

The plugin did not use prepared statement with the categoryid and pdfid parameter when viewing the /wp-admin/admin.php?page=bsk-pdf-manager and /wp-admin/admin.php?page=bsk-pdf-manager-pdfs page leading to Authenticated SQL Injection issues PoC...

WordPress BSK PDF Manager Plugin <= 1.3 - Cross Site Scripting

This plugin is prone to a cross site scripting in wp-admin/admin.php multiple parameter. Solution Upgrade the plugin...

BSK PDF Manager < 2.9.1 - Authenticated Stored Cross-Site Scripting (XSS)

The plugin does not sanitise the view and cattitle POST parameter when creating or editing a category /wp-admin/admin.php?page=bsk-pdf-manager, allowing authenticated users with a role as low as editor to set an XSS payload which will be triggered in the Categories list...

BSK PDF Manager < 1.5 - Multiple Authenticated SQL Injections

The plugin did not use prepared statement with the categoryid and pdfid parameter when viewing the /wp-admin/admin.php?page=bsk-pdf-manager and /wp-admin/admin.php?page=bsk-pdf-manager-pdfs page leading to Authenticated SQL Injection issues...

CVE-2014-4944

Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 categoryid or 2 pdfid parameter to wp-admin/admin.php...

Sql injection

Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 categoryid or 2 pdfid parameter to wp-admin/admin.php...

CVE-2014-4944

CVE-2014-4944 : Multiple SQL injection vulnerabilities in the WordPress plugin BSK PDF Manager (version 1.3.2) allow authenticated remote attackers to execute arbitrary SQL through the parameters categoryid or pdfid in wp-admin/admin.php. Public PoC and exploit references exist showing unsafely c...