CVE-2019-15835

The wp-better-permalinks plugin before 3.0.5 for WordPress has CSRF...

CVE-2019-15835

CVE-2019-15835: The wp-better-permalinks WordPress plugin is affected by a cross-site request forgery (CSRF) vulnerability in all versions before 3.0.5. Attackers could coerce an authenticated user to perform unwanted actions via forged requests. Connected sources consistently identify the vulner...

WordPress WP Better Permalinks plugin <= 3.0.4 - Cross-Site Request Forgery (CSRF) vulnerability

Cross-Site Request Forgery CSRF vulnerability found in WordPress WP Better Permalinks plugin versions = 3.0.4. Solution Update the WordPress WP Better Permalinks plugin to the latest available version at least 3.0.5...

WordPress Custom Permalinks plugin <=1.1 - Authenticated SQL Injection (SQLi) vulnerability

Authenticated SQL Injection SQLi vulnerability found in WordPress Custom Permalinks plugin versions =1.1. Solution Update the WordPress Custom Permalinks plugin to the latest available version at least 1.2...

WordPress Custom Permalinks plugin <=1.1 - Cross-Site Scripting (XSS) vulnerability

Cross-Site Scripting XSS vulnerability found in WordPress Custom Permalinks plugin versions =1.1. Solution Update the WordPress Custom Permalinks plugin to the latest available version at least 1.2...

Custom Permalinks <= 1.1 - Cross-Site Scripting (XSS)

User controllable input in the admin page of Custom Permalinks gets output without any escaping. URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks&s=alert1...

Custom Permalinks <= 1.1 - Cross-Site Scripting (XSS)

User controllable input in the admin page of Custom Permalinks gets output without any escaping. PoC URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks=...

Custom Permalinks <= 1.1 - Authenticated SQL Injection

Missing checking of user controllable input during Bulk Action in the Custom Permalinks backend page leads to SQL injection vulnerability. Send authenticated POST request to "URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks" with parameters "action=delete&permalinks=1 PAYLOAD -- "...

Custom Permalinks <= 1.1 - Authenticated SQL Injection

Missing checking of user controllable input during Bulk Action in the Custom Permalinks backend page leads to SQL injection vulnerability. PoC Send authenticated POST request to "URL/wp-admin/admin.php?page=custom-permalinks-post-permalinks" with parameters "action=delete=1 PAYLOAD -- "...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request...

CVE-2017-10678

Cross-site request forgery CSRF vulnerability in Piwigo through 2.9.1 allows remote attackers to hijack the authentication of users for requests to delete permalinks via a crafted request...

CVE-2017-10678

Cross-site request forgery (CSRF) vulnerability in Piwigo up to version 2.9.1 allows remote attackers to hijack user authentication for requests to delete permalinks via a crafted request. Affected software: Piwigo 2.9.1 and earlier. Underlying risk is authenticated users’ actions being forged, w...

WordPress REST API Bug Could Be Used in Stored XSS Attacks

The recently patched WordPress REST API Endpoint vulnerability is the gift that keeps on giving. Already responsible for more than one million website defacements and attempts to monetize some of those attacks, the flaw also opens the door to a separate attack. Researchers at Sucuri who found the...

WordPress 4.7.3 Patches Half-Dozen Vulnerabilities

WordPress released a security update on Tuesday that patched a half-dozen bugs, including one that could be chained with the recent REST API Endpoint flaw that led to a million website defacements. Given that the bug was introduced in WordPress 4.7 and the availability of a patch that backports...

CVE-2016-1298

Multiple cross-site scripting XSS vulnerabilities in Cisco Unified Contact Center Express 10.01, 10.51, 10.61, and 11.01 allow remote attackers to inject arbitrary web script or HTML via vectors related to permalinks, aka Bug ID CSCux92033...

CVE-2016-1298

Multiple cross-site scripting XSS vulnerabilities in Cisco Unified Contact Center Express 10.01, 10.51, 10.61, and 11.01 allow remote attackers to inject arbitrary web script or HTML via vectors related to permalinks, aka Bug ID CSCux92033...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Cisco Unified Contact Center Express 10.01, 10.51, 10.61, and 11.01 allow remote attackers to inject arbitrary web script or HTML via vectors related to permalinks, aka Bug ID CSCux92033...

CVE-2016-1298

Multiple cross-site scripting XSS vulnerabilities in Cisco Unified Contact Center Express 10.01, 10.51, 10.61, and 11.01 allow remote attackers to inject arbitrary web script or HTML via vectors related to permalinks, aka Bug ID CSCux92033...

CVE-2008-0508

Cross-site request forgery CSRF vulnerability in deanspermalinksmigration.php in the Dean's Permalinks Migration 1.0 plugin for WordPress allows remote attackers to modify the oldstructure aka deanpmconfigoldstructure configuration setting as administrators via the oldstruct parameter in a...

WordPress Migration Plugin <= 1.0 - CSRF

Because of this vulnerability in deanspermalinksmigration.php, the attackers can modify the oldstructure configuration setting. Solution Update the plugin...