217 matches found
CVE-2020-18265: Cross-Site Request Forgery (CSRF)
Cross Site Request Forgery CSRF in Simple-Log v1.6 allows remote attackers to gain privilege and execute arbitrary code via the component "Simple-Log/admin/admin.php?act=actaddmember"...
CVE-2021-24177: Improper Neutralization of Input During Web Page Generation
In the default configuration of the File Manager WordPress plugin before 7.1, a Reflected XSS can occur on the endpoint /wp-admin/admin.php?page=wpfilemanagerproperties when a payload is submitted on the User-Agent parameter. The payload is then reflected back on the web application response...
CVE-2020-10984
Gambio GX (before 4.0.1.0) contains a CSRF vulnerability in admin/admin.php. The CVE entry CVE-2020-10984 documents a cross-site request forgery flaw affecting the admin interface; no explicit remediation is provided in the connected sources. The public references confirm the affected product/ver...
CVE-2020-10984: Cross-Site Request Forgery (CSRF)
Gambio GX before 4.0.1.0 allows admin/admin.php CSRF...
CVE-2019-19109: Cross-Site Request Forgery (CSRF)
The wpForo plugin 1.6.5 for WordPress allows wp-admin/admin.php?page=wpforo-usergroups CSRF...
CVE-2019-19111: Improper Neutralization of Input During Web Page Generation
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases langid parameter...
CVE-2019-19110: Improper Neutralization of Input During Web Page Generation
The wpForo plugin 1.6.5 for WordPress allows XSS via the wp-admin/admin.php?page=wpforo-phrases s parameter...
CVE-2015-2062: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in the Huge-IT Slider slider-image plugin before 2.7.0 for WordPress allow remote administrators to execute arbitrary SQL commands via the removeslide parameter in a popupposts or editcat action in the slidershugeitslider page to wp-admin/admin.php...
CVE-2020-8658: Cross-Site Request Forgery (CSRF)
The BestWebSoft Htaccess plugin through 1.8.1 for WordPress allows wp-admin/admin.php?page=htaccess.php&action=htaccesseditor CSRF. The flag htccssnoncename passes the nonce to WordPress but the plugin does not validate it correctly, resulting in a wrong implementation of anti-CSRF protection. In...
CVE-2020-6849: Cross-Site Request Forgery (CSRF)
The marketo-forms-and-tracking plugin through 1.0.2 for WordPress allows wp-admin/admin.php?page=marketofat CSRF with resultant XSS...
CVE-2020-7047: Improper Privilege Management
The WordPress plugin, WP Database Reset through 3.1, contains a flaw that gave any authenticated user, with minimal permissions, the ability with a simple wp-admin/admin.php?db-reset-tables=users request to escalate their privileges to administrator while dropping all other users from the table...
CVE-2015-9452: Improper Neutralization of Special Elements used in an SQL Command
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nexformsId parameter...
CVE-2015-9454: Improper Neutralization of Special Elements used in an SQL Command
The smooth-slider plugin before 2.7 for WordPress has SQL Injection via the wp-admin/admin.php?page=smooth-slider-admin currentsliderid parameter...
CVE-2015-9428: Cross-Site Request Forgery (CSRF)
The wplegalpages plugin before 1.1 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=legal-pages lp-domain-name, lp-business-name, lp-phone, lp-street, lp-city-state, lp-country, lp-email, lp-address, or lp-niche parameters...
CVE-2015-9442: Cross-Site Request Forgery (CSRF)
The avenirsoft-directdownload plugin 1.0 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=avenirplugin...
CVE-2015-9447: Cross-Site Request Forgery (CSRF)
The unite-gallery-lite plugin before 1.5 for WordPress has CSRF and SQL injection via wp-admin/admin.php galleryid or id parameters...
CVE-2015-9440: Cross-Site Request Forgery (CSRF)
The monetize plugin through 1.03 for WordPress has CSRF with resultant XSS via wp-admin/admin.php?page=monetize-zones-new...
CVE-2015-9448: Improper Neutralization of Special Elements used in an SQL Command
The sendpress plugin before 1.2 for WordPress has SQL Injection via the wp-admin/admin.php?page=sp-queue listid parameter...
CVE-2015-9413: Cross-Site Request Forgery (CSRF)
The eshop plugin through 6.3.13 for WordPress has CSRF with resultant XSS via the wp-admin/admin.php?page=eshop-downloads.php title parameter...