PT-2014-7808

Name of the Vulnerable Software and Affected Versions Huge-IT Image Gallery plugin version 1.0.1 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the removeslide parameter to the "/wp-admin/admin.php" API endpoint. Recommendations For...

CVE-2014-7153: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the editgallery function in admin/galleryfunc.php in the Huge-IT Image Gallery plugin 1.0.1 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the removeslide parameter to wp-admin/admin.php...

HDW Player 2.4.2 - wp-admin/admin.php videos Page id Parameter SQL Injection

The HDW Player Plugin Video Player & Video Gallery WordPress plugin was affected by a wp-admin/admin.php videos Page id Parameter SQL Injection security vulnerability...

Sql injection

SQL injection vulnerability in lib/admin.php in tenfourzero Shutter 0.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

CVE-2014-3904

CVE-2014-3904 affects Shutter 0.1.4 (tenfourzero). The vulnerability is a SQL injection in lib/admin.php that enables remote attackers to execute arbitrary SQL commands via unspecified vectors. Impact is described as possible arbitrary SQL execution with administrative context, potentially affect...

CVE-2014-3904: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in lib/admin.php in tenfourzero Shutter 0.1.4 allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

JVN#48039501: Shutter vulnerable to SQL injection

Shutter provided by tenfourzero is a web package allowing users to share their photos. lib/admin.php in Shutter contains a SQL injection vulnerability. Impact If an administrator views a malicious page while logged in, an arbitrary SQL command may be executed. Solution Uninstall the Software...

Sphider-Search-Engine 1.3.6 /sphider/admin/admin.php SQL注入漏洞

No description provided by source...

CVE-2014-5193

Cross-site scripting XSS vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the category parameter. NOTE: the url parameter vector is already covered by CVE-2014-5082...

CVE-2014-5193

CVE-2014-5193 is an XSS vulnerability in Sphider 1.3.6 specifically in admin/admin.php where the category parameter can inject arbitrary web script or HTML. The note confirms the URL parameter vector is covered by CVE-2014-5082, indicating multiple input vectors in the same product family. The co...

CVE-2014-5192

The vulnerability affects Sphider 1.3.6, specifically in admin/admin.php where the filter parameter is exploitable via SQL injection. The underlying issue enables remote attackers to execute arbitrary SQL commands, with the CVSSv2 base metrics indicating a HIGH impact (Confidentiality/P, Integrit...

CVE-2014-5194

Summary (CVE-2014-5194): Sphider 1.3.6 contains a static code injection flaw in admin/admin.php. Remote authenticated users can exploit the _word_upper_bound parameter to inject arbitrary PHP code into settings/conf.php. This is evidenced by multiple connected sources (exploit-db, packetstorm) de...

PT-2014-6332

Name of the Vulnerable Software and Affected Versions Sphider version 1.3.6 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the category parameter in the admin/admin.php file. Recommendations For Sphider version 1.3.6,...

CVE-2014-5193: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the category parameter. NOTE: the url parameter vector is already covered by CVE-2014-5082...

CVE-2014-5192: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL commands via the filter parameter...

PT-2014-6333

Name of the Vulnerable Software and Affected Versions Sphider version 1.3.6 Description A static code injection issue allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the word upper bound parameter in admin/admin.php. Recommendations For Sphider version...

CVE-2014-5194: Improper Control of Generation of Code

Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the wordupperbound parameter...

PT-2014-6331

Name of the Vulnerable Software and Affected Versions Sphider version 1.3.6 Description A SQL injection issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the filter parameter in the "admin/admin.php" endpoint. Recommendations For Sphider version 1.3.6, avoid...

Sql injection

SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus simple-retail-menus plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php...

CVE-2014-5180

SQL injection vulnerability in the videos page in the HDW Player Plugin hdw-player-video-player-video-gallery 2.4.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the edit action to wp-admin/admin.php...