WordPress Participants Database plugin <= 1.9.5.5 - Authenticated Time Based SQL Injection (SQLi) injection

Authenticated Time Based SQL Injection SQLi injection found by Teacish in WordPress Participants Database plugin versions = 1.9.5.5. Solution Update the WordPress Participants Database plugin to the latest available version at least 1.9.5.6...

Participants Database < 1.9.5.6 - Authenticated Time Based SQL Injection

Authenticated time-based SQL injection via the ascdesc, listfiltercount, and sortBy parameters. PoC Form the original advisory see references: POST /wp-admin/admin.php?page=participants-database HTTP/1.1 Host: redacted....cause User-Agent: Mozilla/5.0 X11; Linux x8664; rv:68.0 Gecko/20100101...

Participants Database <= 1.7.5.9 - Cross-Site Scripting

Cross site scripting XSS vulnerability in the Wordpress Participants Database plugin 1.7.59 allows attackers to inject arbitrary javascript via the Name parameter. curl -k -F action=signup -F subsource=participants-database -F shortcodepage=/?pageid=1 -F thankspage=/?pageid=1 -F instanceindex=2 -...

WordPress Participants Database plugin <=1.7.5.9 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found by Benjamin Lim in WordPress Participants Database plugin version 1.7.5.9 and earlier versions. Data of the text input field of the plugin passed without escaping HTML special characters thus allows an attacker to insert javascript. Solution Update the...

WordPress Participants Database Plugin Cross-Site Scripting Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . Participants Database is one of the Participants Database plugin . A cross-site scripting vulnerability exists in...

CVE-2017-14126

The Participants Database plugin before 1.7.5.10 for WordPress has XSS...

CVE-2017-14126

The Participants Database plugin before 1.7.5.10 for WordPress has XSS...

Cross site scripting

The Participants Database plugin before 1.7.5.10 for WordPress has XSS...

CVE-2017-14126

The CVE-2017-14126 entry concerns the WordPress Participants Database plugin prior to version 1.7.5.10, which is affected by a Cross-Site Scripting (XSS) flaw. The root cause is that text input data (notably the signup form’s Name field) is passed without escaping HTML special characters, enablin...

CVE-2017-14126

The Participants Database plugin before 1.7.5.10 for WordPress has XSS...

WordPress Plugin Participants Database 1.7.5.10 - Cross-Site Scripting

WordPress Plugin Participants Database 1.7.5.10 - Cross-Site Scripting Exploit Title: Wordpress Plugin Participants Database 1.7.5.10 - XSS Google Dork: inurl:wp-content/plugins/participants-database/ Date: 01-Sep-17 Exploit Author: Benjamin Lim Vendor Homepage: https://xnau.com/ Software Link:...

WordPress Plugin Participants Database < 1.7.5.10 - Cross-Site Scripting

Exploit Title: Wordpress Plugin Participants Database 1.7.5.10 - XSS Google Dork: inurl:wp-content/plugins/participants-database/ Date: 01-Sep-17 Exploit Author: Benjamin Lim Vendor Homepage: https://xnau.com/ Software Link: https://wordpress.org/plugins/participants-database/ Version: 1.7.5.9...

WordPress Participants Database plugin <= 1.7.5.3 - Cross-Site Request Forgery (CSRF)/Authenticated Arbitrary File Upload Vulnerabilities

A Cross-Site Request Forgery CSRF/Authenticated Arbitrary File Upload Vulnerabilities in WordPress Participants Database plugin = 1.7.5.3 can allow an attacker to upload arbitrary files. The vulnerability exsists in PDbCSVImport class file which doesn't check for the file type of the file. With...

Wordpress Participants Database 1.5.4.8 - SQL Injection

No description provided by source...

WordPress Participants database v1.5.4.8 SQL注入漏洞

No description provided by source...

Participants Database Plugin for WordPress < 1.5.4.9 'query' Parameter SQL Injection

The Participants Database Plugin for WordPress installed on the remote host is prior to version 1.5.4.9. It is, therefore, affected by a SQL injection vulnerability due to failure to properly sanitize user-supplied input to the 'query' parameter in the 'pdb-signup' script. A remote, unauthenticat...

Yarubo #1: Arbitrary SQL Execution in Participants Database for Wordpress

Yarubo 1: Arbitrary SQL Execution in Participants Database for Wordpress ========================================================= Program: Participants Database = 1.5.4.8 Severity: Unauthenticated attacker can fully compromise the Wordpress installation Permalink:...

CVE-2014-3961

SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/...

Sql injection

SQL injection vulnerability in the Export CSV page in the Participants Database plugin before 1.5.4.9 for WordPress allows remote attackers to execute arbitrary SQL commands via the query parameter in an "output CSV" action to pdb-signup/...

CVE-2014-3961

The CVE-2014-3961 issue affects the WordPress Participants Database plugin prior to 1.5.4.9, where an SQL injection is possible via the query parameter in the export CSV action (pdb-signup/). The root cause is improper sanitization of user input in the export CSV workflow, enabling remote attacke...