CVE-2015-3325

CVE-2015-3325 affects the WordPress WP Symposium plugin, specifically the forum.php component. The vulnerability is a SQL injection via the show parameter in the QUERY_STRING, allowing an unauthenticated, remote attacker to manipulate or disclose data in the back-end database. The issue is tied t...

CVE-2014-10021

Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/...

Unrestricted file upload

Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/...

CVE-2014-10021

The WP Symposium plugin 14.11 for WordPress contains an unrestricted file upload vulnerability in UploadHandler.php. A remote, unauthenticated attacker can exploit this by using a specially crafted request to upload a file with an executable extension (e.g., .php ). Because the /wp-symposium/serv...

WordPress Symposium Plugin 14.11 - Shell Upload

Symposium plugin is prone to a shell upload vulnerability. It allows an attacker to execute arbitrary PHP code by making a direct request to the uploaded .php file. Solution Update the plugin...

PT-2015-3665

Name of the Vulnerable Software and Affected Versions WP Symposium plugin version 14.11 Description The issue allows remote attackers to execute arbitrary code by uploading a file with an executable extension to the UploadHandler.php file in the WP Symposium plugin, and then accessing it via a...

WordPress WP Symposium plugin has multiple cross-site scripting vulnerabilities

WordPress WP Symposium plugins are web plugins that add social features. WP Symposium 14.11 and prior versions fail to properly validate uploaded file types, allowing under attackers to upload and execute arbitrary php code...

WordPress WP Symposium Plugin 'tray' SQL Injection Vulnerability

WordPress WP Symposium plugins are web plugins that add social features. WP Symposium fails to properly filter the value of the 'tray' POST parameter in wp-symposium/ajax/mailfunctions.php when action is set to getMailMessage and mid is set to a valid message ID, allowing attackers to inject...

CVE-2014-8810

SQL injection vulnerability in ajax/mailfunctions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action...

CVE-2014-8809

Multiple cross-site scripting XSS vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter in an addComment action to ajax/profilefunctions.php, 2 composetext parameter in a sendMail action to...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 text parameter in an addComment action to ajax/profilefunctions.php, 2 composetext parameter in a sendMail action to...

CVE-2014-8810

SQL injection vulnerability in ajax/mailfunctions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action...

CVE-2014-8810

WP Symposium plugin for WordPress (

WordPress Symposium Plugin 14.10 - SQL Injection

This WordPress Symposium plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update to version 14.11...

WordPress Symposium Plugin <= 14.10 - Multiple XSS

Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the 4 parameters: "composetext" in a sendMail action to ajax/mailfunctions.php, "text" in an addComment action to ajax/profilefunctions.php, "comment" in an addcomment action to ajax/loungefunctions.php, o...

CVE-2013-2694

Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the u parameter...

Open redirect

Open redirect vulnerability in invite.php in the WP Symposium plugin 13.04 for WordPress allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the u parameter...

CVE-2013-2694

WP Symposium WordPress plugin 13.04 contains an open redirect in invite.php exploitable via the u parameter, allowing redirects to arbitrary sites (phishing). Root cause: unvalidated/redirect parameters. Exploitation details are not provided in the connected documents. Impact is open redirect; no...

PT-2014-2615

Name of the Vulnerable Software and Affected Versions WP Symposium plugin version 13.04 Description The issue allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the u parameter in the invite.php file. This can be exploited to trick users int...

WordPress Symposium Plugin XSS Vulnerability

The WordPress plugin SPDX-FileCopyrightText: 2013 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...