CVE-2017-1002012

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/adminsetting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement...

CVE-2017-1002012

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, In image-gallery-with-slideshow/adminsetting.php the following snippet of code does not sanitize input via the gid variable before passing it into an SQL statement...

CVE-2017-1002014

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/adminsetting.php via galleryname parameter...

CVE-2017-1002014

Vulnerability in wordpress plugin image-gallery-with-slideshow v1.5.2, Blind SQL Injection in image-gallery-with-slideshow/adminsetting.php via galleryname parameter...

CVE-2017-1002013

CVE-2017-1002013 affects WordPress plugin Image Gallery with Slideshow (v1.5.2) and is due to a Blind SQL Injection via the imgid parameter in image-gallery-with-slideshow/admin_setting.php. The vulnerability allows a remote attacker (no authentication) to send crafted requests over the network a...

CVE-2017-1002011

CVE-2017-1002011 affects the WordPress plugin image-gallery-with-slideshow up to version 1.5.2 . The vulnerability is a stored XSS where an attacker with privileges to modify or add galleries/images can inject JavaScript into the database via the fields $value->gallery_name and $value->gall...

CVE-2017-1002015

The CVE-2017-1002015 entry covers a vulnerability in the WordPress plugin Image Gallery with Slideshow, version 1.5.2, where a Blind SQL Injection exists in image-gallery-with-slideshow/admin_setting.php through the selectMulGallery parameter. This is evidenced by multiple connected records (NVD,...

CVE-2017-1002014

The CVE-2017-1002014 entry concerns the WordPress plugin image-gallery-with-slideshow (version 1.5.2). A SQL injection exists in admin_setting.php via the gallery_name parameter, enabling arbitrary SQL execution. The vulnerability is documented as Blind SQL Injection, with effects described in so...

CVE-2017-1002012

CVE-2017-1002012 : Vulnerability in the WordPress plugin image-gallery-with-slideshow (version 1.5.2) where admin_setting.php does not sanitize the gid input before including it in an SQL statement, enabling SQL injection. Multiple sources (NVD and Red Hat CVE pages, CNVD) describe this vulnerabi...

WordPress Cool Flickr Slideshow 1.0 Cross Site Scripting

| | Exploit Title: Wordpress cool-flickr-slideshow Plugin Cross Site Scriptingxss | Exploit Author: Ashiyane Digital security Team | Vendor Homepage:https://wordpress.org/plugins/cool-flickr-slideshow/ | Software Link: https://downloads.wordpress.org/plugin/cool-flickr-slideshow.1.0.zip | Version...

CVE-2017-12439

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

CVE-2017-12439

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

CVE-2017-12439

SocuSoft Flash Slideshow Maker Professional through v5.20, when the advanced configuration is used, has an xmlpath HTTP parameter that trusts user-supplied input, in conjunction with an unsafe XML configuration file. This has resultant content forgery, cross site scripting, and unvalidated...

CVE-2017-12439

The CVE-2017-12439 entry concerns SocuSoft Flash Slideshow Maker Professional up to version 5.20. When advanced configuration is used, the xml_path HTTP parameter trusts user-supplied input in conjunction with an unsafe XML configuration file, enabling issues described as content forgery, cross-s...

Socusoft: XSS in HTML Content Generated by Flash Slideshow Maker (All Versions)

The vulnerability identified does not exist within the software application itself, instead, the vulnerability presents itself within the application's exported files which end up hosted on an external web-server. Socusoft's Flash Slideshow Maker application has two configuration themes associate...

WordPress Plugin Slideshow 'SlideshowPluginSlideshowStyleshe' Information Disclosure Vulnerability

WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . Slideshow is one of the plugin to add slideshow . A security vulnerability exists in the...

Input validation

The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values...

CVE-2015-3634

The SlideshowPluginSlideshowStylesheet::loadStylesheetByAJAX function in the Slideshow plugin 2.2.8 through 2.2.21 for Wordpress allows remote attackers to read arbitrary Wordpress option values...

WordPress Simple Slideshow Manager Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in Wordpress Simple Slideshow Manager, which can be exploited by remote attackers...

Simple Slideshow Manager <= 2.3 – Multiple Vulnerabilities

The Simple Slideshow Manager WordPress plugin was affected by security vulnerability. PoC 3.1 Cross-Site Scripting Vulnerable Function: echo Vulnerable Variable: $GET'name' Vulnerable URL: http://www.vulnerablesite.com/wp-admin/admin.php?page=Acurax-Slideshow-AddImages="alert42...