Wordpress Webcam 2Way Videochat Plagin XSS Vulnerability

The VideoWhisper 2 Way Video Chat is a web based video application designed for instant 1 on 1 private online video conferencing. Exploit Title : Wordpress Plugin Webcam 2Way Videochat XSS Vulnerability Exploit Author : NULLPointer Date : 17/09/2014 Download Link :...

WordPress Theme LaBomba Arbitrary File Download Vulnerability

Exploit for php platform in category web applications Exploit Title : WordPress Theme LaBomba Arbitrary File Download Vulnerability Exploit Author : NULLPointer Date : 17/09/2014 Vendor Homepage : http://themeforest.net/item/labomba-responsive-multipurpose-wordpress-theme/6106367 Version: 1.7...

WordPress core theme Arbitrary File Download Vulnerability

Usage Info Download Config From The Target. http://localhost/wp-admin/admin-ajax.php?action=revslidershowimage&img=../wp-config.php Exploit Title: WordPress core theme Arbitrary File Download Vulnerability Date: 2014/09/11 Google Dork : inurl:/wp-content/themes/core/framework/wordpress-importer/...

WordPress Plugin WP to Twitter - Authentication Bypass

WordPress Plugin WP to Twitter - Authentication Bypass source: https://www.securityfocus.com/bid/69741/info WP to Twitter Plugin for WordPress is prone to an authorization-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized...

Mulitple WordPress Themes (admin-ajax.php, img param) - Arbitrary File Download

No description provided by source. WordPress CuckooTap Theme & eShop Arbitrary File Download Risk: High CWE number: CWE-200 Author: Hugo Santiago Contact: [email protected] Date: 31/08/2014 Vendor Homepage: http://themeforest.net/item/cuckootap-one-page-parallax-wp-theme-plus-eshop/3512405...

Mulitple WordPress Themes - admin-ajax.php?img Arbitrary File Download

Mulitple WordPress Themes - admin-ajax.php?img Arbitrary File Download WordPress CuckooTap Theme & eShop Arbitrary File Download Risk: High CWE number: CWE-200 Author: Hugo Santiago Contact: [email protected] Date: 31/08/2014 Vendor Homepage:...

Mulitple WordPress Themes - 'admin-ajax.php?img' Arbitrary File Download

WordPress CuckooTap Theme & eShop Arbitrary File Download Risk: High CWE number: CWE-200 Author: Hugo Santiago Contact: [email protected] Date: 31/08/2014 Vendor Homepage: http://themeforest.net/item/cuckootap-one-page-parallax-wp-theme-plus-eshop/3512405 Tested on: Windows 7 and Gnu/Linux...

Sql injection

SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a goviewobject action to wp-admin/admin-ajax.php...

Wordpress 2.1.3 admin-ajax.php SQL Injection Blind Fishing Exploit

...

Ajax Pagination 1.1 - wp-admin/admin-ajax.php loop Parameter Local File Inclusion

Plugin is still affected and has been closed...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the 1 buried or 2 featured status of a comment via a request to wp-admin/admin-ajax.php...

CVE-2014-4163

Multiple cross-site request forgery CSRF vulnerabilities in the Featured Comments plugin 1.2.1 for WordPress allow remote attackers to hijack the authentication of administrators for requests that change the 1 buried or 2 featured status of a comment via a request to wp-admin/admin-ajax.php...

WordPress Featured Comments 1.2.1 Cross Site Request Forgery

Details ================ Software: Featured Comments Version: 1.2.1 Homepage: http://wordpress.org/plugins/feature-comments/ Advisory ID: dxw-2014-1360 CVE: Awaiting assignment CVSS: 4.3 Medium; AV:N/AC:M/Au:N/C:N/I:P/A:N Description ================ CSRF in Featured Comments 1.2.1 allows an...

CVE-2014-3210

CVE-2014-3210 describes an SQL injection in the WordPress Booking System (Booking Calendar) plugin. The vulnerability affects the plugin’s dopbs-backend-forms.php and allows remote authenticated users to execute arbitrary SQL commands via the booking_form_id parameter sent to wp-admin/admin-ajax....

Wordpress Work-The-Flow Plugin 1.2.1 - Arbitrary File Upload

Exploit for php platform in category web applications Author: nopesled Date: 24/04/14 Software: https://wordpress.org/plugins/work-the-flow-file-upload/ Company: http://wtf-fu.com/ Version: 1.2.1 Tested on: Windows 7 Vulnerability: Unrestricted File Upload Submit an image file via the wtf upload...

WordPress Work-The-Flow 1.2.1 Shell Upload

Author: nopesled Date: 24/04/14 Software: https://wordpress.org/plugins/work-the-flow-file-upload/ Company: http://wtf-fu.com/ Version: 1.2.1 Tested on: Windows 7 Vulnerability: Unrestricted File Upload Submit an image file via the wtf upload panel and intercept the POST request to...

WordPress Plugin Work-The-Flow 1.2.1 - Arbitrary File Upload

WordPress Plugin Work-The-Flow 1.2.1 - Arbitrary File Upload Author: nopesled Date: 24/04/14 Software: https://wordpress.org/plugins/work-the-flow-file-upload/ Company: http://wtf-fu.com/ Version: 1.2.1 Tested on: Windows 7 Vulnerability: Unrestricted File Upload Submit an image file via the wtf...

WordPress Ajax Pagination插件'admin-ajax.php'本地文件包含漏洞

Bugtraq ID:66526 WordPress是一款内容管理系统。 由于'admin-ajax.php'脚本没有正确过滤用户提交的输入，攻击者可以利用漏洞包含本地文件，以WEB权限查看系统文件。 0 WordPress Ajax Pagination Plugin 1.1 目前没有详细解决方案： http://wordpress.org/plugins/ajax-pagination/...

Cross site scripting

Cross-site scripting XSS vulnerability in the CommentLuv plugin before 2.92.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the ajaxnonce parameter to wp-admin/admin-ajax.php...

CVE-2013-1409

CVE-2013-1409 affects the WordPress CommentLuv plugin prior to 2.92.4. The vulnerability is a cross-site scripting (XSS) flaw in the _ajax_nonce parameter passed to wp-admin/admin-ajax.php, allowing an attacker to inject arbitrary script/HTML. CVSSv2 base score listed as 4.3 (Medium) with I-P imp...