CVE-2026-5333: Improper Neutralization of Special Elements used in a Command

A security flaw has been discovered in DefaultFuction Content-Management-System 1.0. This issue affects some unknown processing of the file /admin/tools.php. The manipulation of the argument host results in command injection. The attack can be executed remotely. The exploit has been released to t...

CVE-2015-20115: Improper Neutralization of Input During Web Page Generation

Next Click Ventures RealtyScript 4.0.2 fails to properly sanitize file uploads, allowing attackers to store malicious scripts through the file POST parameter in admin/tools.php. Attackers can upload files containing JavaScript code that executes in the context of admin/tools.php when accessed by...

EUVD-2015-9241

Malware in sbrugna...

CVE-2019-17207: Improper Neutralization of Input During Web Page Generation

A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker aka Broken Link Checker plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the...

CVE-2015-9398

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection...

CVE-2015-9398: Improper Neutralization of Special Elements used in an SQL Command

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection...

CVE-2015-9401: Improper Neutralization of Input During Web Page Generation

The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php editstyle id XSS...

CVE-2015-9397: Improper Neutralization of Input During Web Page Generation

The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS...

CVE-2016-10983: Improper Authentication

The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data...

CVE-2016-10944: Cross-Site Request Forgery (CSRF)

The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF...

CVE-2017-18603: Improper Neutralization of Input During Web Page Generation

The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postmanemaillog page parameter...

CVE-2013-6993: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php...

CVE-2013-6991: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the procname parameter to wp-admin/tools.php...

CVE-2012-2916: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in sabreclassadmin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the activeoption parameter to wp-admin/tools.php...