80 matches found
CVE-2021-24522
CVE-2021-24522 affects ProfilePress (formerly WP User Avatar) for WordPress, before version 3.1.11. The tabbed login/register widget is vulnerable to unauthenticated reflected XSS due to improper escaping, with some cases enabling replication via $_GET because $_POST values were mapped to $_GET. ...
CVE-2021-32106
In ICEcoder 8.0 allows, a reflected XSS vulnerability was identified in the multipe-results.php page due to insufficient sanitization of the GET'replace' variable. As a result, arbitrary Javascript code can get executed...
Denial Of Service (DoS)
kernel is vulnerable to denial of service. The vulnerability exists due to a memory leak in the sofsetgetlargectrldata function in sound/soc/sof/ipc.c which allows an attacker to crash the application via malicious input...
CVE-2020-19879
DBHcms v1.2.0 is vulnerable to a stored cross-site scripting (XSS) due to lack of input filtering on $_GET['dbhcms_pid'] in dbhcms\page.php (line 107). CVE-2020-19879 has CVSS v2 base 4.3 (NETWORK, MEDIUM) and CVSS v3.1 base 6.1 (NETWORK, MEDIUM) with user interaction required. Exploitation detai...
CVE-2020-19879
DBHcms v1.2.0 has a stored xss vulnerability as there is no security filter of $GET'dbhcmspid' variable in dbhcms\page.php line 107,...
Email Verification for WooCommerce < 1.8.2 - Loose Comparison to Authentication Bypass
The plugin is affected by a loose comparison issue, which could allow any user to log in as administrator. An attacker can manipulate $GET'algwcevverifyemail' and set this payload: eyJpZCI6MSwiY29kZSI6MH0= Example: https://example.com/my-account/?algwcevverifyemail=eyJpZCI6MSwiY29kZSI6MH0= after...
CVE-2019-11591
The WebDorado Contact Form plugin before 1.13.5 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the latter is...
CVE-2019-11567
An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $GET'del', as demonstrated by an admin/page/system/nav.php?del= URI...
Sql injection
An issue was discovered in AikCms v2.0. There is a SQL Injection vulnerability via $GET'del', as demonstrated by an admin/page/system/nav.php?del= URI...
CVE-2019-11557
The WebDorado Contact Form Builder plugin before 1.0.69 for WordPress allows CSRF via the wp-admin/admin-ajax.php action parameter, with resultant local file inclusion via directory traversal, because there can be a discrepancy between the $POST'action' value and the $GET'action' value, and the...
Cross site scripting
Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting XSS vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid...
CVE-2017-17454
Mahara 16.10 before 16.10.7 and 17.04 before 17.04.5 and 17.10 before 17.10.2 have a Cross Site Scripting XSS vulnerability when a user enters invalid UTF-8 characters. These are now going to be discarded in Mahara along with NULL characters and invalid Unicode characters. Mahara will also avoid...
Smooth Slider <= 2.8.6 - Authenticated SQL Injection
During the security analysis, ThunderScan discovered SQL injection vulnerability in Smooth Slider WordPress plugin. The easiest way to reproduce the vulnerability is to visit the provided URL while being logged in as administrator or another user that is authorized to access the plugin settings...
Arbitrary file deletion
Fiyo CMS 2.0.7 has an arbitrary file read vulnerability in dapur/apps/apptheme/libs/checkfile.php via $GET'src' or $GET'name'...
WordPress Active Directory Integration plugin <=1.1.8 - Authenticated SQL Injection (SQLi) vulnerability
Authenticated SQL Injection SQLi vulnerability found by Lenon Leite in WordPress Active Directory Integration plugin versions = 1.1.8. The plugin is vulnerable due to unescaped $GET‘userid’. Solution 11/20/2017 - we were unable to find a patched version of this plugin...
Link-Library <= 5.9.13.26 – Authenticated SQL Injection
Type user access: admin user. $GET‘linkid’ is not escaped. PoC http://localhost:8080/wp-admin/admin.php?page=link-library=1=1+UNION+SELECT+1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,CONCATuserlogin,char58,userpass,17,18,19,20,21,22,23,24,25,26+FROM+wpusers+WHERE+ID=1...
Pluck CMS 4.7.4 Cross Site Request Forgery
============================================== Exploit Title : pluck-cms vulnerability CSRF Reported Date : 8 - 10 - 2017 Exploit Author : Ashiyane Digital Security Team CWE: CSRF - 352 Tested On : kali Linux Vendor Homepage : https://www.pluck-cms.org/ Software Link :...
SQL Injection
Subrion is vulnerable to SQL Injection attacks. The library does not have any checking for user input through the $GET parameter in /front/search.php, allowing a malicious user to inject and execute arbitrary SQL...