admin gadget rest endpoint information leak

the admin rest endpoint can return admin-only information even if the end user is not an admin...

PT-2008-2242 · Dmssoftware · Dmsguestbook

Name of the Vulnerable Software and Affected Versions: DMSGuestbook version 1.7.0 Description: The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the "file" parameter to "wp-admin/admin.php", the "messagefield" parameter in the guestbook page, or th...

PT-2008-1843 · WordPress · Wp-Contactform

Name of the Vulnerable Software and Affected Versions: WP-ContactForm plugin for WordPress versions 1.5 alpha and earlier Description: The issue concerns multiple cross-site request forgery CSRF vulnerabilities. These vulnerabilities allow remote attackers to perform actions as administrators. Th...