345 matches found
Code injection
The Showbiz Pro plugin through 1.7.1 for WordPress has PHP code execution by uploading a .php file within a ZIP archive...
Cross site scripting
The elementor-edit-template class in wp-admin/customize.php in the Elementor Pro plugin before 2.0.10 for WordPress has XSS...
CVE-2018-18379
The CVE-2018-18379 entry concerns the Elementor Pro WordPress plugin before version 2.0.10, where the elementor-edit-template class in wp-admin/customize.php enables cross-site scripting due to improper validation of client-side data. The vulnerability affects Elementor Pro on WordPress and is ex...
CVE-2015-9418
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes...
Cross site request forgery (csrf)
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes...
Defeating Compiler-Level Obfuscations Used in APT10 Malware
Summary The Carbon Black Threat Analysis Unit TAU recently analyzed a series of malware samples that utilized compiler-level obfuscations. For example, opaque predicates were applied to Turla mosquito and APT10 ANEL. Another obfuscation, control flow flattening, was applied to APT10 ANEL and Dhar...
WordPress Payment Form for PayPal Pro Plugin Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Payment Form for PayPal Pro plugin is used in one of the payment plugin. WordPress Payment Form for PayPal Pro...
CVE-2015-4073
Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the 1 ticketcode or 2 email parameter or 3 remote authenticated users to execute arbitrary SQL commands via the filterorder parameter...
Directory traversal
Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter in a ticket.downloadattachment task...
CVE-2015-4074
Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter in a ticket.downloadattachment task...
CVE-2015-4075
CVE-2015-4075 – Joomla! Helpdesk Pro (
CVE-2015-4073
Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the 1 ticketcode or 2 email parameter or 3 remote authenticated users to execute arbitrary SQL commands via the filterorder parameter...
CVE-2015-4074
CVE-2015-4074 is a proven Local File Inclusion / path traversal vulnerability in the Joomla! Helpdesk Pro plugin < 1.4.0. The issue allows reading arbitrary files via a .. in the filename parameter of the ticket.download_attachment task. Affected software: Joomla! Helpdesk Pro plugin versions ...
CVE-2015-4071
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://target/component/helpdeskpro/?view=ticket&id=ticketId...
Code injection
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://target/component/helpdeskpro/?view=ticket&id=ticketId...
CVE-2015-4071
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://target/component/helpdeskpro/?view=ticket&id=ticketId...
CVE-2015-4071
CVE-2015-4071 affects the Joomla! Helpdesk Pro Plugin prior to version 1.4.0. The vulnerability is an information disclosure: remote attackers can read arbitrary users’ support tickets by obtaining a ticketId and visiting /component/helpdeskpro/?view=ticket&id={ticketId}. Root cause is improper a...
WordPress Ads Pro plugin <= 3.4 - Cross-Site Scripting / SQL Injection
bsaproid $GET parameter is vulnerable to SQL injection. Payload example: bsaprostats=1&[email protected]&bsaproid=xx AND 1707=1707 The payload works when the ad is displayed. Solution Update the plugin to the latest version...