CVE-2026-4138: Cross-Site Request Forgery (CSRF)

The DX Unanswered Comments plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.7. This is due to missing nonce validation on the plugin's settings form in the dxuc-unanswered-comments-admin-page.php file. This makes it possible for...

CVE-2025-14999: Cross-Site Request Forgery (CSRF)

The Latest Tabs plugin for WordPress is vulnerable to Cross-Site Request Forgery in all versions up to, and including, 1.5. This is due to missing or incorrect nonce validation on the settings update handler in admin-page.php. This makes it possible for unauthenticated attackers to modify plugin...

CVE-2025-4936: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in projectworlds Online Food Ordering System 1.0. It has been classified as critical. Affected is an unknown function of the file /admin-page.php. The manipulation of the argument 1price leads to sql injection. It is possible to launch the attack remotely. The exploit ha...

Cross site scripting

The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

CVE-2021-34654 Custom Post Type Relations <= 1.0 Reflected Cross-Site Scripting

The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

PT-2021-20622

Name of the Vulnerable Software and Affected Versions: Custom Post Type Relations WordPress plugin version 1.0 and earlier Description: The issue allows attackers to inject arbitrary web scripts via the cptrname parameter found in the /pages/admin-page.php file, enabling Reflected Cross-Site...

CVE-2021-34654: Improper Neutralization of Input During Web Page Generation

The Custom Post Type Relations WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the cptrname parameter found in the /pages/admin-page.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.0...

PT-2018-15427

Name of the Vulnerable Software and Affected Versions DouPHP version 1.5 20181221 Description An issue was discovered in DouCo DouPHP, where the "admin/page.php?rec=edit" endpoint has a cross-site scripting XSS issue via the page name parameter. Recommendations For DouPHP version 1.5 20181221,...

CVE-2018-20557: Improper Neutralization of Input During Web Page Generation

An issue was discovered in DouCo DouPHP 1.5 20181221. admin/page.php?rec=edit has XSS via the pagename parameter...

CVE-2018-1000638

MiniCMS version 1.1 contains a Cross Site Scripting XSS vulnerability in http://example.org/mc-admin/page.php?date=payload that can result in code injection...

CVE-2004-2364: Undefined Security Weakness

Cross-site request forgery CSRF vulnerability in PHPX 3.0 through 3.2.6 allows remote attackers to execute arbitrary commands via URLs that are automatically executed on behalf of the administrator, as demonstrated using 1 admin/page.php, 2 admin/news.php, 3 admin/user.php, 4 admin/images.php, 5...