7184 matches found
CVE-2015-5499
The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...
DLA-294-1 wordpress - security update
Bulletin has no description...
[SECURITY] [DSA 3332-1] wordpress security update
------------------------------------------------------------------------- Debian Security Advisory DSA-3332-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst August 11, 2015 https://www.debian.org/security/faq -...
WordPress Plugin Recent Backups 0.7 - Arbitrary File Download
Title: Remote file download vulnerability in recent-backups v0.7 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-13 Download Site: https://wordpress.org/plugins/recent-backups Vendor: https://profiles.wordpress.org/andycheeseman/ Vendor Notified: 0000-00-00 Vendor Contact:...
WordPress Altos Connect Widget 1.3.0 Cross Site Scripting Vulnerability
WordPress Altos Connect Widget plugin version 1.3.0 suffers from a cross site scripting vulnerability. Title: WordPress 'Altos Connect Widget' Plugin Version: 1.3.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-15 Download: - https://wordpress.org/plugins/altos-connect/ -...
Altos Connect Widget <= 1.3.0 - Unauthenticated Cross-Site Scripting (XSS)
The altos-connect WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/"...
WordPress Altos Connect Widget Plugin <= 1.3.0 - Cross Site Scripting (XSS)
This plugin is prone to a cross site scripting vulnerability, because "PHPSELF" is printed without sanitization in a captcha demo page. Solution Update the plugin...
WordPress <= 4.2.3 - XSS #2
This vulnerability exists in the WPNavMenuWidget class in wp-includes/default-widgets.php in the "form" function. It allows remote attackers to inject arbitrary web script or HTML via a widget title. Related records: http://db.threatpress.com/vulnerability/wordpress/wordpress-4-2-3-xss Solution...
WordPress Altos Connect Widget 1.3.0 Cross Site Scripting
Title: WordPress 'Altos Connect Widget' Plugin Version: 1.3.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-15 Download: - https://wordpress.org/plugins/altos-connect/ - https://plugins.svn.wordpress.org/altos-connect/ Notified WordPress: 2015-06-21...
Oracle Application Express Cross Site Scripting Vulnerability
Exploit for multiple platform in category web applications title: Permanent Cross-Site Scripting product: Oracle Application Express vulnerable version: All versions prior to 4.2.3.00.08 fixed version: 4.2.3.00.08 CVE number: CVE-2015-2655 impact: high homepage: https://apex.oracle.com/i/index.ht...
SQL Injection Vulnerability in Widget Parameters of Hangzhou Elite Online Education Technology Online Learning Platform
Hangzhou Elite Online Education Technology Online Learning Platform is an education and training platform. A SQL injection vulnerability exists in the widget parameters of the WidgetsHandler.ashx page of the Hangzhou Elite Online Education Technology online learning platform. Comprehensive...
CVE-2015-4084 - WordPress Free Counter Plugin [Stored XSS]
Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link: https://wordpress.org/plugins/free-counter/ Version: 1.1 Tested on: WordPress 4.2.2...
WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting
WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link:...
WordPress Plugin Free Counter 1.1 Stored XSS Vulnerability
Exploit for php platform in category web applications Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link:...
WordPress Free Counter 1.1 Cross Site Scripting
Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link: https://wordpress.org/plugins/free-counter/ Version: 1.1 Tested on: WordPress 4.2.2...
WordPress Wise Search Widget Plugin <= 1.1 - Cross Site Scripting
This plugin is prone to a cross site scripting vulnerability via "s" parameter. Solution Upgrade this plugin...
WordPress Wise Search Widget Plugin <= 1.1 - Cross Site Scripting
This plugin is prone to a cross site scripting vulnerability via "s" parameter. Solution Upgrade this plugin...
WordPress Random Image Widget Plugin - Full Path Disclosure
This plugin is prone to a full path disclosure vulnerability. Solution Update plugin...