5632 matches found
CVE-2014-9735
The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...
Directory traversal
Directory traversal vulnerability in the Slider Revolution revslider plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php...
Cross site scripting
Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...
CVE-2014-9734
Directory traversal vulnerability in the Slider Revolution revslider plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php...
CVE-2015-5151
Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...
CVE-2014-9734
The Slider Revolution (revslider) plugin for WordPress, in versions prior to 4.2 , contains a directory traversal vulnerability. The root cause is a failure to adequately filter the img parameter in the revslider_show_image action handled by the wp-admin/admin-ajax.php script. A remote attacker c...
CVE-2014-9735
The ThemePunch Slider Revolution (revslider) plugin (before version 3.0.96) and the Showbiz Pro plugin (version 1.7.1 and earlier) for WordPress contain a vulnerability due to improper restriction of administrator AJAX functionality . This flaw allows remote attackers to perform multiple unauthor...
CVE-2015-5151
CVE-2015-5151 affects the WordPress Slider Revolution (Revslider) plugin version 4.2.2. The vulnerability stems from inadequate validation/filtering of the client_action parameter in the revslider_ajax_action action called by wp-admin/admin-ajax.php, allowing remote attackers to inject arbitrary ...
CVE-2014-9735
The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...
PT-2015-4368
Name of the Vulnerable Software and Affected Versions Slider Revolution revslider plugin versions prior to 4.2 for WordPress Description The issue allows remote attackers to read arbitrary files by exploiting a directory traversal vulnerability in the Slider Revolution plugin. This is achieved by...
PT-2015-6786
Name of the Vulnerable Software and Affected Versions Slider Revolution plugin version 4.2.2 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the client action parameter in a revslider ajax action action to "wp-admin/admin-ajax.php"...
WordPress Slider Revolution Plugin <= 3.0.95 - Multiple Vulnerabilities
Because of these vulnerabilities, the attackers can upload and execute arbitrary files, create, update, import or export arbitrary sliders via unspecified vectors, also, delete arbitrary sliders. Solution Update the plugin...
WordPress Slider Revolution Plugin <= 4.2.2 - XSS
This vulnerability allows an attacker to inject arbitrary web script or HTML via the "clientaction" parameter. Solution Update the plugin...
CVE-2015-5151: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Slider Revolution revslider plugin 4.2.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the clientaction parameter in a revsliderajaxaction action to wp-admin/admin-ajax.php...
CVE-2014-9735: Undefined Security Weakness
The ThemePunch Slider Revolution revslider plugin before 3.0.96 for WordPress and Showbiz Pro plugin 1.7.1 and earlier for Wordpress does not properly restrict access to administrator AJAX functionality, which allows remote attackers to 1 upload and execute arbitrary files via an updateplugin...
CVE-2014-9734: Improper Limitation of a Pathname to a Restricted Directory
Directory traversal vulnerability in the Slider Revolution revslider plugin before 4.2 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the img parameter in a revslidershowimage action to wp-admin/admin-ajax.php...
WordPress Huge IT Slider Plugin 2.7.5 - Multiple Vulnerabilities
There are multiple vulnerabilities in this plugin, such as cross-site request forgery and Persistent JS/HTML Injection. These vulnerabilities allow an attacker to make a user with access privileges to a page and inject JavaScript into the database. Solution Upgrade the plugin...
WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities
WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities Exploit Title: WordPress: wordpress huge-it-slider 2.7.5 & Persistent JS-HTML Code injection, Arbitrary slider deletion Date: 2015-06-23 Google Dork: intitle:"index of" intext:"/wp-content/plugins/slider-image/" Exploit Author:...
WordPress Plugin Huge-IT Slider 2.7.5 - Multiple Vulnerabilities
Exploit Title: WordPress: wordpress huge-it-slider 2.7.5 & Persistent JS-HTML Code injection, Arbitrary slider deletion Date: 2015-06-23 Google Dork: intitle:"index of" intext:"/wp-content/plugins/slider-image/" Exploit Author: Joaquin Ramirez Martinez i0akiN SEC-LABORATORY Software Link:...