PowerPress Podcasting < 6.0.1 - Cross-Site Scripting (XSS)

The PowerPress Podcasting plugin by Blubrry WordPress plugin was affected by a Cross-Site Scripting XSS security vulnerability. /wp-admin/admin.php?page=powerpress/powerpressadmincategoryfeeds.php&action=powerpress-editcategoryfeed&cat=1';"--alert0x014068...

53KF /admin/ShowPersonHzList.aspx SQL注入漏洞

No description provided by source...

CVE-2014-7956

Cross-site scripting XSS vulnerability in the Pods plugin before 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter in an edit action in the pods page to wp-admin/admin.php...

Cross site request forgery (csrf)

Multiple cross-site request forgery CSRF vulnerabilities in the Facebook Like Box cardoza-facebook-like-box plugin before 2.8.3 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct...

WordPress Simplelife 1.2 CSRF / XSS

Title: CSRF / Stored XSS Vulnerability in Simplelife Wordpress Plugin Author: Manideep K CVE-ID: CVE-2014-9395 Plugin Homepage: https://wordpress.org/plugins/simplelife/ Version Affected: 1.2 probably lower versions Severity: High Description: Vulnerable Parameter: multiple fields such as...

WordPress twimp-wp Cross Site Request Forgery / Cross Site Scripting

Title: CSRF / Stored XSS Vulnerability in twimp-wp Plugin Author: Manideep K CVE-ID: CVE-2014-9397 Plugin Homepage: https://wordpress.org/plugins/twimp-wp/ Version Affected: probably lower versions Severity: High Description: Vulnerable Parameter: all text boxes , to name one - id &...

CVE-2014-9281

Cross-site scripting XSS vulnerability in admin/copyfield.php in MantisBT before 1.2.18 allows remote attackers to inject arbitrary web script or HTML via the destid field...

WordPress PWG Random Plugin <= 1.11 - Multiple Vulnerabilities

This plugin is prone to a cross site scripting and cross site request forgery attacks. The attackers can insert arbitrary script into admin page. Once exploited, admin’s browser can be made to do almost anything the admin user could typically do by hijacking admin's cookies . Parameters...

WordPress Apptha Video Gallery Plugin <= 2.5 - Multiple SQL Injection

Because of these vulnerabilities, the attackers can execute arbitrary SQL commands via the "videoId" parameter in a newvideo page to wp-admin/admin.php, "vid" parameter in a myextract action to wp-admin/admin-ajax.php or "playlistId" parameter in the newplaylist page. Solution Update the plugin...

Cross site scripting

Cross-site scripting XSS vulnerability in admin/htaccess/bpsunlock.php in the BulletProof Security plugin before .51.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the dbhost parameter...

Cross site scripting

Cross-site scripting XSS vulnerability in the Wordfence Security plugin before 5.1.4 for WordPress allows remote attackers to inject arbitrary web script or HTML via the whoisval parameter on the WordfenceWhois page to wp-admin/admin.php...

CVE-2014-8577

Multiple cross-site scripting XSS vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 dataContacttitle parameter to admin/contacts/contacts/add page; 2 dataBlocktitle or 3 dataBlockalias parameter to admin/blocks/blocks/edit page; 4...

CVE-2014-8577

Multiple cross-site scripting XSS vulnerabilities in Croogo before 2.1.0 allow remote attackers to inject arbitrary web script or HTML via the 1 dataContacttitle parameter to admin/contacts/contacts/add page; 2 dataBlocktitle or 3 dataBlockalias parameter to admin/blocks/blocks/edit page; 4...

PT-2014-7820 · WordPress · Wp Google Maps

Name of the Vulnerable Software and Affected Versions: WP Google Maps plugin versions prior to 6.0.27 Description: The issue allows remote attackers to inject arbitrary web script or HTML via the poly id parameter in an edit poly, edit polyline, or edit marker action in the "wp-google-maps-menu"...

Cross site scripting

Cross-site scripting XSS vulnerability in In-Portal CMS 5.2.0 and earlier allows remote attackers to inject arbitrary web script or HTML via the nexttemplate parameter to admin/index.php...

CVE-2014-7139

Multiple cross-site scripting XSS vulnerabilities in the Contact Form DB aka CFDB and contact-form-7-to-database-extension plugin before 2.8.16 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 form or 2 enc parameter in the CF7DBPluginShortCodeBuilder page to...

WordPress Login Widget With Shortcode Plugin 3.1.1 - Multiple Vulnerabilities

Login Widget With Shortcode plugin is prone to CSRF and XSS vulnerabilities that allow an attacker to insert arbitrary HTML into an admin page. Then an attacker can use Javascript to control an admin user’s browser and create user accounts, posts, etc. Solution Update the plugin...

CMS AutoWeb 3.0 SQL Injection Vulnerability

CMS AutoWeb version 3.0 suffers from a remote SQL injection vulnerability. Note that this finding houses site-specific data. + Sql Injection on CMS AutoWeb v3.0 + Date: 24/09/2014 + CWE Number : CWE-89 + Risk: High + Author: Felipe Andrian Peixoto + Vendor Homepage: http://www.multdivision.com.br...

CMS AutoWeb 3.0 SQL Injection

Sql Injection on CMS AutoWeb v3.0 + Date: 24/09/2014 + CWE Number : CWE-89 + Risk: High + Author: Felipe Andrian Peixoto + Vendor Homepage: http://www.multdivision.com.br + Contact: [email protected] + Tested on: Windows 7 and Linux + Vulnerable File: mostrar.php + Dork :...

Shutter vulnerable to SQL injection

Overview Shutter provided by tenfourzero is a web package allowing users to share their photos. lib/admin.php in Shutter contains a SQL injection vulnerability. Yuji Tounai of bogus.jp reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early...