386 matches found
CVE-2018-18379
The CVE-2018-18379 entry concerns the Elementor Pro WordPress plugin before version 2.0.10, where the elementor-edit-template class in wp-admin/customize.php enables cross-site scripting due to improper validation of client-side data. The vulnerability affects Elementor Pro on WordPress and is ex...
CVE-2015-9418
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes...
Cross site request forgery (csrf)
The Watu Pro plugin before 4.9.0.8 for WordPress has CSRF that allows an attacker to delete quizzes...
Defeating Compiler-Level Obfuscations Used in APT10 Malware
Summary The Carbon Black Threat Analysis Unit TAU recently analyzed a series of malware samples that utilized compiler-level obfuscations. For example, opaque predicates were applied to Turla mosquito and APT10 ANEL. Another obfuscation, control flow flattening, was applied to APT10 ANEL and Dhar...
WordPress Payment Form for PayPal Pro Plugin Cross-Site Scripting Vulnerability
WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports PHP and MySQL servers to set up a personal blog site.Payment Form for PayPal Pro plugin is used in one of the payment plugin. WordPress Payment Form for PayPal Pro...
CVE-2015-4073
Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the 1 ticketcode or 2 email parameter or 3 remote authenticated users to execute arbitrary SQL commands via the filterorder parameter...
CVE-2015-4074
Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter in a ticket.downloadattachment task...
Directory traversal
Directory traversal vulnerability in the Helpdesk Pro plugin before 1.4.0 for Joomla! allows remote attackers to read arbitrary files via a .. dot dot in the filename parameter in a ticket.downloadattachment task...
CVE-2015-4075
CVE-2015-4075 – Joomla! Helpdesk Pro (
CVE-2015-4074
The Joomla! Helpdesk Pro plugin (versions prior to 1.4.0 ) is vulnerable to a directory traversal vulnerability. This flaw allows remote attackers to read arbitrary files on the server by using .. (dot dot) sequences in the filename parameter within the ticket.download_attachment task. Exploitati...
CVE-2015-4073
Multiple SQL injection vulnerabilities in the Helpdesk Pro plugin before 1.4.0 for Joomla! allow remote attackers to execute arbitrary SQL commands via the 1 ticketcode or 2 email parameter or 3 remote authenticated users to execute arbitrary SQL commands via the filterorder parameter...
CVE-2015-4071
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://target/component/helpdeskpro/?view=ticket&id=ticketId...
Code injection
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://target/component/helpdeskpro/?view=ticket&id=ticketId...
CVE-2015-4071
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://target/component/helpdeskpro/?view=ticket&id=ticketId...
CVE-2015-4071
CVE-2015-4071 affects the Joomla! Helpdesk Pro Plugin prior to version 1.4.0. The vulnerability is an information disclosure: remote attackers can read arbitrary users’ support tickets by obtaining a ticketId and visiting /component/helpdeskpro/?view=ticket&id={ticketId}. Root cause is improper a...
CVE-2015-4071: Exposure of Sensitive Information to an Unauthorized Actor
The Helpdesk Pro Plugin before 1.4.0 for Joomla! allows remote attackers to read the support tickets of arbitrary users via obtaining the target ticketId, and navigating to http://target/component/helpdeskpro/?view=ticket&id=ticketId...
WordPress Ads Pro plugin <= 3.4 - Cross-Site Scripting / SQL Injection
bsaproid $GET parameter is vulnerable to SQL injection. Payload example: bsaprostats=1&[email protected]&bsaproid=xx AND 1707=1707 The payload works when the ad is displayed. Solution Update the plugin to the latest version...
WordPress FB Survey Pro Plugin - Cross Site Scripting
This plugin is prone to a cross site scripting vulnerability. Solution Update the plugin...
WordPress FB Survey Pro Plugin - Cross Site Scripting
This plugin is prone to a cross site scripting vulnerability. Solution Update the plugin...
VulnCheck KEV: CVE-2014-9735
The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...