CVE-2019-12516: Improper Neutralization of Special Elements used in an SQL Command

The slickquiz plugin through 1.3.7.1 for WordPress allows SQL Injection by Subscriber users, as demonstrated by a /wp-admin/admin.php?page=slickquiz-scores&id= or /wp-admin/admin.php?page=slickquiz-edit&id= or /wp-admin/admin.php?page=slickquiz-preview&id= URI...

CVE-2019-15867: Use of Hard-coded Credentials

The slick-popup plugin before 1.7.2 for WordPress has a hardcoded OmakPass13 password for the slickpopupteam account, after a Subscriber calls a certain AJAX action...

CVE-2019-11701: Improper Neutralization of Input During Web Page Generation

The default webcal: protocol handler will load a web site vulnerable to cross-site scripting XSS attacks. This default was left in place as a legacy feature and has now been removed. Note: this issue only affects users with an account on the vulnerable service. Other users are unaffected.. This...

CVE-2018-20155: Missing Authorization

The WP Maintenance Mode plugin before 2.0.7 for WordPress allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings...

PT-2018-15276

Name of the Vulnerable Software and Affected Versions WP Maintenance Mode plugin versions prior to 2.0.7 Description The issue allows remote authenticated subscriber users to bypass intended access restrictions on changes to plugin settings. Recommendations For WP Maintenance Mode plugin versions...

CVE-2018-6960: Improper Authentication

VMware Horizon DaaS 7.x before 8.0.0 contains a broken authentication vulnerability that may allow an attacker to bypass two-factor authentication. Note: In order to exploit this issue, an attacker must have a legitimate account on Horizon DaaS...

CVE-2017-7255: Improper Neutralization of Input During Web Page Generation

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1title parameter. Someone must login to conduct the attack...

CVE-2017-7256: Improper Neutralization of Input During Web Page Generation

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1summary parameter. Someone must login to conduct the attack...

CVE-2017-7257: Improper Neutralization of Input During Web Page Generation

XSS exists in the CMS Made Simple CMSMS 2.1.6 "Content--News--Add Article" feature via the m1content parameter. Someone must login to conduct the attack...

CVE-2016-1597: Undefined Security Weakness

A logged-in user in NetIQ Access Governance Suite 6.0 through 6.4 could escalate privileges to administrator...