Cross site scripting

Cross-site scripting XSS vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-1567

Cross-site scripting XSS vulnerability in the admin page in the GD Infinite Scroll module before 7.x-1.4 for Drupal allows remote authenticated users with the "edit gd infinite scroll settings" permission to inject arbitrary web script or HTML via unspecified vectors...

CVE-2015-1567

Affected software: Drupal GD Infinite Scroll module (before 7.x-1.4). Vulnerability: Cross-site scripting (XSS) on the admin page due to insufficient input sanitization, exploitable by remote authenticated users holding the 'edit gd infinite scroll settings' permission. Vectors are not specified ...

Vpersian CMS SQL Injection Vulnerability

Remote SQL injection vulnerabilities in vperisan cms . Exploit Title : Vpersian CMS SQL Injection and Authentication bypass Author : Abolfazl74 Home page Link : http://vpersian.net Date : 03/02/2015 Version: All versions Google dork: intext:"VPersian CMS" email : email protected // Vulnerability...

PT-2015-5258 · Blubrry · Blubrry Powerpress Podcasting Plugin

Name of the Vulnerable Software and Affected Versions: Blubrry PowerPress Podcasting plugin versions prior to 6.0.1 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the cat parameter in a "powerpress-editcategoryfeed" action in the "powerpressadmin...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Gecko CMS 2.2 and 2.3 allow remote attackers to inject arbitrary web script or HTML via the 1 horder, 2 jakcatid, 3 jakcontent, 4 jakcss, 5 jakdeletelog, 6 jakemail, 7 jakextfile, 8 jakfile, 9 jakhookshow, 10 jakimg, 11 jakjavascript, 12...

PowerPress Podcasting < 6.0.1 - Cross-Site Scripting (XSS)

The PowerPress Podcasting plugin by Blubrry WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability. /wp-admin/admin.php?page=powerpress/powerpressadmincategoryfeeds.php&action=powerpress-editcategoryfeed&cat=1';"--alert0x014068...

53KF /admin/ShowPersonHzList.aspx SQL注入漏洞

No description provided by source...

CVE-2014-7956

Cross-site scripting XSS vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Facebook Like Box cardoza-facebook-like-box plugin before 2.8.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct...

WordPress twimp-wp Cross Site Request Forgery / Cross Site Scripting

Title: CSRF / Stored XSS Vulnerability in twimp-wp Plugin Author: Manideep K CVE-ID: CVE-2014-9397 Plugin Homepage: https://wordpress.org/plugins/twimp-wp/ Version Affected: probably lower versions Severity: High Description: Vulnerable Parameter: all text boxes , to name one - id &...

WordPress Simplelife 1.2 CSRF / XSS

Title: CSRF / Stored XSS Vulnerability in Simplelife Wordpress Plugin Author: Manideep K CVE-ID: CVE-2014-9395 Plugin Homepage: https://wordpress.org/plugins/simplelife/ Version Affected: 1.2 probably lower versions Severity: High Description: Vulnerable Parameter: multiple fields such as...

CVE-2014-9281

Cross-site scripting XSS vulnerability in admin/copyfield.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the destid field...

WordPress PWG Random Plugin <= 1.11 - Multiple Vulnerabilities

This plugin is prone to a cross site scripting and cross site request forgery attacks. The attackers can insert arbitrary script into admin page. Once exploited, admin’s browser can be made to do almost anything the admin user could typically do by hijacking admin's cookies . Parameters...

WordPress Apptha Video Gallery Plugin <= 2.5 - Multiple SQL Injection

Because of these vulnerabilities, the attackers can execute arbitrary SQL commands via the "videoId" parameter in a newvideo page to wp-admin/admin.php, "vid" parameter in a myextract action to wp-admin/admin-ajax.php or "playlistId" parameter in the newplaylist page. Solution Update the plugin...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dbhost parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php...

CVE-2014-8577

Multiple cross-site scripting XSS vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 dataContacttitle parameter to admin/contacts/contacts/add page; 2 dataBlocktitle or 3 dataBlockalias parameter to admin/blocks/blocks/edit page; 4...

CVE-2014-8577

Multiple cross-site scripting XSS vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 dataContacttitle parameter to admin/contacts/contacts/add page; 2 dataBlocktitle or 3 dataBlockalias parameter to admin/blocks/blocks/edit page; 4...

PT-2014-7820 · WordPress · Wp Google Maps

Name of the Vulnerable Software and Affected Versions: WP Google Maps plugin versions prior to 6.0.27 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the poly id parameter in an edit poly, edit polyline, or edit marker action in the "wp-google-maps-menu"...