CVE-2015-3325

CVE-2015-3325 affects the WordPress WP Symposium plugin, specifically the forum.php component. The vulnerability is a SQL injection via the show parameter in the QUERY_STRING, allowing an unauthenticated, remote attacker to manipulate or disclose data in the back-end database. The issue is tied t...

CVE-2014-10021

Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/...

Unrestricted file upload

Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/...

CVE-2014-10021

The CVE-2014-10021 entry concerns the WP Symposium WordPress plugin (version 14.11). It describes an unauthenticated, unrestricted file upload vulnerability in UploadHandler.php that allows an attacker to upload a file with an executable extension and then access it via a direct URL to execute ar...

WordPress Symposium Plugin 14.11 - Shell Upload

Symposium plugin is prone to a shell upload vulnerability. It allows an attacker to execute arbitrary PHP code by making a direct request to the uploaded .php file. Solution Update the plugin...

WordPress WP Symposium plugin has multiple cross-site scripting vulnerabilities

WordPress WP Symposium plugins are web plugins that add social features. WP Symposium 14.11 and prior versions fail to properly validate uploaded file types, allowing under attackers to upload and execute arbitrary php code...

WordPress WP Symposium Plugin 'tray' SQL Injection Vulnerability

WordPress WP Symposium plugins are web plugins that add social features. WP Symposium fails to properly filter the value of the 'tray' POST parameter in wp-symposium/ajax/mailfunctions.php when action is set to getMailMessage and mid is set to a valid message ID, allowing attackers to inject...

CVE-2014-8810

SQL injection vulnerability in ajax/mailfunctions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action...

CVE-2014-8809

Multiple cross-site scripting XSS vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter in an addComment action to ajax/profilefunctions.php, 2 composetext parameter in a sendMail action to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter in an addComment action to ajax/profilefunctions.php, 2 composetext parameter in a sendMail action to...

CVE-2014-8810

SQL injection vulnerability in ajax/mailfunctions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action...

CVE-2014-8810

WP Symposium plugin for WordPress (

WordPress Symposium Plugin 14.10 - SQL Injection

This WordPress Symposium plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update to version 14.11...

WordPress Symposium Plugin <= 14.10 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the 4 parameters: "composetext" in a sendMail action to ajax/mailfunctions.php, "text" in an addComment action to ajax/profilefunctions.php, "comment" in an addcomment action to ajax/loungefunctions.php, o...

CVE-2013-2694

Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the u parameter...

Open redirect

Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the u parameter...

CVE-2013-2694

WP Symposium WordPress plugin 13.04 contains an open redirect in invite.php exploitable via the u parameter, allowing redirects to arbitrary sites (phishing). Root cause: unvalidated/redirect parameters. Exploitation details are not provided in the connected documents. Impact is open redirect; no...

WordPress Symposium Plugin XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...

WordPress Symposium Plugin <= 13.03 - Open Redirection

Because of this vulnerability in invite.php, the attackers can redirect users to arbitrary web sites and conduct phishing attacks via a URL in the "u" parameter. Solution Update the plugin...

WordPress Symposium Plugin <= 13.03 - XSS

Because of this vulnerability in invite.php in, the attackers can inject arbitrary web script or HTML via the "u" parameter. Solution Update the plugin...