1408 matches found
CVE-2011-4908
TinyBrowser plugin for Joomla! before 1.5.13 allows arbitrary file upload via upload.php...
Minimal Coming Soon & Maintenance Mode < 2.15 - CSRF to Stored XSS and Setting Changes
This plugin had no nonce checks on any of the settings to verify that a request came from a legitimate source, such as a logged in administrative user. Therefore, creating a CSRF to stored XSS in addition to significant setting changes. PoC...
Code injection
Jenkins Google Compute Engine Plugin 4.1.1 and earlier does not verify SSH host keys when connecting agents created by the plugin, enabling man-in-the-middle attacks...
WordPress wp-live-chat-support plugin cross-site scripting vulnerability (CNVD-2019-36074)
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. wp-live-chat-support plugin is a live chat plugin used in it. A cross-site scripting vulnerability exists in the WordPress...
CVE-2015-9480
The RobotCPA plugin 5 for WordPress has directory traversal via the f.php l parameter...
CVE-2015-9461
The awesome-filterable-portfolio plugin before 1.9 for WordPress has afpgetnewportfolioitempage SQL injection via the itemid parameter...
WP Google Map Plugin < 4.1.0 - CSRF to Unauthenticated PHP Object Injection
The WP Google Map Plugin WordPress plugin was affected by a CSRF to Unauthenticated PHP Object Injection security vulnerability...
MGASA-2019-0273 Updated flash-player-plugin packages fix security vulnerabilities
Updated flash-player-plugin package fixes security vulnerabilities: Same origin method execution that leads to arbitrary code execution in the context of the current user. CVE-2019-8069 Use after free that leads to arbitrary code execution in the context of the current user. CVE-2019-8070...
CVE-2019-15834
The webp-converter-for-media plugin before 1.0.3 for WordPress has CSRF...
CVE-2019-15773
The nd-travel plugin before 1.7 for WordPress has a nopriv AJAX action that allows modification of the siteurl setting...
WordPress gallery-by-supsystic plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. gallery-by-supsystic is an image gallery plugin used in it. A cross-site request forgery vulnerability exists in the WordPress...
CVE-2019-15648
The insert-or-embed-articulate-content-into-wordpress plugin before 4.29991 for WordPress has insufficient restrictions on deleting or renaming by a Subscriber...
WordPress democracy-poll plugin cross-site request forgery vulnerability
WordPress is a blogging platform developed by the WordPress Foundation using the PHP language. The platform supports personal blog sites on PHP and MySQL servers. democracy-poll is an online poll plugin used in it. A cross-site request forgery vulnerability exists in the WordPress democracy-poll...
CVE-2016-10916
The appointment-booking-calendar plugin before 1.1.24 for WordPress has SQL injection, a different vulnerability than CVE-2015-7319...
CVE-2019-15110
The wp-front-end-profile plugin before 0.2.2 for WordPress has XSS...
CVE-2017-18536
The stop-user-enumeration plugin before 1.3.8 for WordPress has XSS...
CVE-2017-18533
The rimons-twitter-widget plugin before 1.3 for WordPress has XSS...
CVE-2016-10884
The simple-membership plugin before 3.3.3 for WordPress has multiple CSRF issues...