109 matches found
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 callback, 2 dir, or 3 extensions parameter in an addImages action to wp-admin/admin-ajax.php...
CVE-2014-6315
Multiple cross-site scripting XSS vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 callback, 2 dir, or 3 extensions parameter in an addImages action to wp-admin/admin-ajax.php...
CVE-2014-6315
CVE-2014-6315 concerns the WordPress plugin Photo Gallery (Web-Dorado) up to version 1.1.30. The vulnerability is a set of Cross-Site Scripting (XSS) flaws exposed via three HTTP GET/parameters to wp-admin/admin-ajax.php: callback, dir, and extensions. The root cause is insufficient sanitization ...
WordPress Photo Gallery 1.1.30 Cross Site Scripting Vulnerability
WordPress Photo Gallery plugin version 1.1.30 suffers from a cross site scripting vulnerability. Product: Photo Gallery WordPress plugin Vendor: http://web-dorado.com/ Vulnerable Versions: 1.1.30 and probably prior Tested Version: 1.1.30 Advisory Publication: September 10, 2014 without technical...
WordPress Photo Gallery 1.1.30 Cross Site Scripting
Advisory ID: HTB23232 Product: Photo Gallery WordPress plugin Vendor: http://web-dorado.com/ Vulnerable Versions: 1.1.30 and probably prior Tested Version: 1.1.30 Advisory Publication: September 10, 2014 without technical details Vendor Notification: September 10, 2014 Vendor Patch: September 10,...
WordPress Web-Dorado Photo Gallery Plugin <= 1.1.30 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML via the "callback", "dir", or "extensions" parameters. Solution Update the plugin...
Joomla Spider Contacts <= 1.3.6 SQL Injection Exploit
Exploit for php platform in category web applications !/usr/bin/env python Exploit Title : Joomla Spider Contacts = 1.3.6 SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://web-dorado.com/ Software Link :...
Joomla! Component Spider Contacts 1.3.6 - contacts_id SQL Injection
Joomla! Component Spider Contacts 1.3.6 - contactsid SQL Injection !/usr/bin/env python Exploit Title : Joomla Spider Contacts = 1.3.6 SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://web-dorado.com/ Software Link :...
WordPress Spider Facebook 1.0.8 SQL Injection
Exploit Title : Wordpress Spider Facebook 1.0.8 Authenticated SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://web-dorado.com/ Software Link : http://downloads.wordpress.org/plugin/spider-facebook.1.0.8.zip Date : 2014-08-25 Tested on : Windows 7 / Mozilla Firefox Linux /...
Joomla Spider 2.8.3 SQL Injection
Exploit Title : Joomla Spider video player 2.8.3 SQL Injection Exploit Author : Claudio Viviani Vendor Homepage : http://web-dorado.com/ Software Link : http://extensions.joomla.org/extensions/multimedia/multimedia-players/video-players-a-gallery/22321 Dork Google:...
Wordpress Plugin spider calendar Multiple Vulnerabilities
No description provided by source. Exploit Title: Wordpress spider calendar Plugin Multiple Vulnerabilities Dork: N/A Date: 02-10-2012 Author: Daniel Barragan D4NB4R Twitter: @D4NB4R Vendor: http://wordpress.org/extend/plugins/spider-calendar/ Version: 1.0.1 License: Non-Commercial Demo:...
Joomla Spider Catalog (index.php, product_id parameter) SQL Injection Vulnerability
No description provided by source. 1 1 0 I'm D4NB4R member from Inj3ct0r Team 1 1 0 0-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-=-==-=-=-1 Exploit Title: Joomla comspidercatalog SQL injection Vulnerability Dork: inurl:index.php?option=comspidercatalog Date: 31-10-2012 Author:...
Joomla Spider Calendar Lite (com_spidercalendar) SQL Injection
No description provided by source. Exploit Title: Joomla spider calendar lite Remote Exploit dork: inurl:comspidercalendar Date: 29-08-2012 Author: Daniel Barragan D4NB4R Twitter: @D4NB4R site: http://poisonsecurity.wordpress.com/ Vendor: http://web-dorado.com/products/spider-calendar-lite.html...
WordPress Spider Video Player 2.1 Cross Site Scripting
==================================================================== Exploit Title : WordPress Spider Video Player 2.1 Cross site scripting Vulnerability Exploit Author : Ashiyane Digital Security Team Vendor Homepage : http://web-dorado.com/ Google Dork :...
Spider contacts, 1.3.3,
Spider contacts, 1.3.3, SQL Injection Extension Update Details We have fixed the vulnerability on Spider Contacts. We have changed the version to 1.3.4 on JED and also added corresponding text to the description. UpdateNoticeURL http://web-dorado.com/products/joomla-contacts.html...
Spider Event Calendar 1.3.0 Cross Site Scripting / Path Disclosure / SQL Injection
waraxe-2013-SA104 - Multiple Vulnerabilities in Spider Event Calendar Wordpress Plugin =================================================================================== Author: Janek Vind "waraxe" Date: 22. May 2013 Location: Estonia, Tartu Web: http://www.waraxe.us/advisory-104.html Descriptio...
CVE-2013-3532
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the theme parameter...
Sql injection
SQL injection vulnerability in settings.php in the Web Dorado Spider Video Player plugin 2.1 for WordPress allows remote attackers to execute arbitrary SQL commands via the theme parameter...
CVE-2013-3532
CVE-2013-3532 describes an SQL injection in the Web Dorado Spider Video Player (SpiderVPlayer) WordPress plugin, version 2.1, exposed via the settings.php theme parameter. The root cause is unparameterized SQL handling, permitting remote attackers to execute arbitrary SQL commands. Impact per sou...