CVE-2011-5051

Summary: CVE-2011-5051 affects the WP Symposium WordPress plugin prior to 11.12.24. The vulnerability is an unrestricted file upload in two endpoints (uploadify/upload_admin_avatar.php and uploadify/upload_profile_avatar.php). An attacker could upload a file with an executable extension and then ...

WordPress Symposium Plugin <= 11.12.24 - Multiple Arbitrary File Upload

Because of this vulnerability, the attackers can execute arbitrary code by uploading a file with an executable extension using uploadify/uploadprofileavatar.php or uploadify/uploadadminavatar.php. Solution Update the plugin...

CVE-2011-3841

The CVE-2011-3841 entry concerns the WordPress WP Symposium plugin vulnerability: a Cross-Site Scripting (XSS) flaw in the file uploadify/get_profile_avatar.php that allows arbitrary script/HTML injection via the uid parameter. Affected versions are before 11.12.08. Root cause: input handling in ...

WordPress Symposium Plugin <= 11.12.07 - XSS

Because of this vulnerability in uploadify/getprofileavatar.php, the attackers can inject arbitrary web script or HTML via the "uid" parameter. Solution Update the plugin...

WordPress Symposium Plugin <= 0.64 - SQL Injection

This WordPress Symposium plugin is prone to an SQL injection. This vulnerability allows an attacker to modify data, compromise the access and application or exploit hidden vulnerabilities in the underlying database. Solution Update the plugin...

WordPress Plugin Symposium 0.64 - SQL Injection

Exploit Title: WordPress WP Symposium plugin 1,BENCHMARK5000000,MD5CHAR115,113,108,109,97,112,0 --------------- Vulnerable code --------------- $uid = $REQUEST'uid'; $sql = "SELECT profileavatar FROM ".$wpdb-baseprefix."symposiumusermeta WHERE uid = ".$uid;...