CVE-2019-14680

The admin-renamer-extended aka Admin renamer extended plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF...

CVE-2019-14680: Cross-Site Request Forgery (CSRF)

The admin-renamer-extended aka Admin renamer extended plugin 3.2.1 for WordPress allows wp-admin/plugins.php?page=admin-renamer-extended/admin.php CSRF...

CVE-2016-10751

osClass 3.6.1 allows oc-admin/plugins.php Directory Traversal via the plugin parameter. This is exploitable for remote PHP code execution because an administrator can upload an image that contains PHP code in the EXIF data via index.php?page=ajax&action=ajaxupload...

CVE-2018-17125

CScms 4.1 allows arbitrary directory deletion via a dir=..\ substring to plugins\sys\admin\Plugins.php...

CVE-2017-6816

In WordPress before 4.7.3 wp-admin/plugins.php, unintended files can be deleted by administrators using the plugin deletion functionality...

CVE-2017-6816: Incorrect Authorization

In WordPress before 4.7.3 wp-admin/plugins.php, unintended files can be deleted by administrators using the plugin deletion functionality...

CVE-2014-2340: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the XCloner plugin before 3.1.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to wp-admin/plugins.php...

PT-2014-4634

Name of the Vulnerable Software and Affected Versions XCloner plugin versions prior to 3.1.1 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that create website backups via a request to "wp-admin/plugins.php"...

CVE-2010-5295

Cross-site scripting XSS vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action...

CVE-2010-5295: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in wp-admin/plugins.php in WordPress before 3.0.2 might allow remote attackers to inject arbitrary web script or HTML via a plugin's author field, which is not properly handled during a Delete Plugin action...

CVE-2012-4422

wp-admin/plugins.php in WordPress before 3.4.2, when the multisite feature is enabled, does not check for network-administrator privileges before performing a network-wide activation of an installed plugin, which might allow remote authenticated users to make unintended plugin changes by leveragi...

PT-2012-5392

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.4.2 Description The issue allows remote authenticated users to make unintended plugin changes by leveraging the Administrator role, due to insufficient privilege checks in the multisite feature. This occurs becaus...

CVE-2012-2402

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors...

CVE-2012-2402: Undefined Security Weakness

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors...

WordPress 3.0.1 wp-admin/plugins.php模块跨站脚本漏洞

BUGTRAQ ID: 42440 WordPress是一款免费的论坛Blog系统。 如果action参数设置为delete-selected，WordPress没有正确地过滤提交给wp-admin/plugins.php的checked0参数便返回给了用户，这允许远程攻击者通过提交恶意参数请求执行反射式跨站脚本攻击。 WordPress 3.0.1 厂商补丁： WordPress --------- 目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本： http://wordpress.org/...

CVE-2008-2699

Multiple directory traversal vulnerabilities in Galatolo WebManager GWM 1.0 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in 1 the plugin parameter to admin/plugins.php or 2 the com parameter to index.php...

CVE-2008-2699: Improper Limitation of a Pathname to a Restricted Directory

Multiple directory traversal vulnerabilities in Galatolo WebManager GWM 1.0 allow remote attackers to include and execute arbitrary local files via directory traversal sequences in 1 the plugin parameter to admin/plugins.php or 2 the com parameter to index.php...

MyBB 1.2 Local File Incusion

Invalid characters removed from From: [email protected], |@securityfocus.com, D3vil-0x1 MyBB Bug Local File Inclusion MyBB 1.2 - Admin Can Include Local File : File :- admin/plugins.php Line :- 51 // if$mybb-input'action' == "activate" $codename = $mybb-input'plugin'; Input From POST $file =...