CVE-2014-4944

Multiple SQL injection vulnerabilities in inc/bsk-pdf-dashboard.php in the BSK PDF Manager plugin 1.3.2 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 categoryid or 2 pdfid parameter to wp-admin/admin.php...

PT-2014-6223

Name of the Vulnerable Software and Affected Versions BSK PDF Manager plugin version 1.3.2 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the categoryid or pdfid parameter to the "wp-admin/admin.php" endpoint. Recommendations For BS...

Sql injection

SQL injection vulnerability in the WP Rss Poster wp-rss-poster plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php...

CVE-2014-4938

SQL injection vulnerability in the WP Rss Poster wp-rss-poster plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php...

CVE-2014-4938: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the WP Rss Poster wp-rss-poster plugin 1.0.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter in the wrp-add-new page to wp-admin/admin.php...

PT-2014-6217

Name of the Vulnerable Software and Affected Versions WP Rss Poster wp-rss-poster plugin version 1.0.0 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the id parameter in the "wrp-add-new" page to "wp-admin/admin.php". Recommendations For WP R...

CVE-2014-4939: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the ENL Newsletter enl-newsletter plugin 1.0.1 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the enl-add-new page to wp-admin/admin.php...

PT-2014-6218

Name of the Vulnerable Software and Affected Versions enl-newsletter plugin version 1.0.1 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the id parameter in the "enl-add-new" page to "wp-admin/admin.php". Recommendations Fo...

CVE-2014-4854

Cross-site scripting XSS vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuclogo parameter in a save action to wp-admin/admin.php...

PT-2014-6160

Name of the Vulnerable Software and Affected Versions Meta Slider plugin version 2.5 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the id parameter to "wp-admin/admin.php". Recommendations For Meta Slider plugin version 2.5, avoid usin...

FengCms 1.19 /admin.php 登录绕过漏洞

No description provided by source...

PT-2014-6168

Name of the Vulnerable Software and Affected Versions WP Construction Mode plugin version 1.8 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the wuc logo parameter in a save action to "wp-admin/admin.php". Recommendations For WP...

CVE-2014-4846: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the Meta Slider ml-slider plugin 2.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the id parameter to wp-admin/admin.php...

CVE-2014-4854: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in the WP Construction Mode plugin 1.8 for WordPress allows remote attackers to inject arbitrary web script or HTML via the wuclogo parameter in a save action to wp-admin/admin.php...

REvolution <= 10.02 CSRF (Cross-Site Request Forgery)

No description provided by source. Vulnerability ID: HTB22367 Reference: http://www.htbridge.ch/advisory/xsrfcsrfinnpdsrevolution.html Product: NPDS REvolution Vendor: NPDS Vulnerable Version: REvolution 10.02 and Probably Prior Versions Vendor Notification: 06 May 2010 Vulnerability Type: CSRF...

PHP-Nuke 0-7 Delete God Admin Access Control Bypass Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/10861/info PHP-Nuke is reported prone to an access control bypass vulnerability. Reports indicate that a PHP-Nuke superuser may bypass access controls and privilege restrictions, to delete the PHP-Nuke God Admin account...

NPDS 4.8 /5.0 admin.php language Parameter XSS

No description provided by source. source: http://www.securityfocus.com/bid/13803/info NPDS is affected by multiple vulnerabilities resulting from input validation errors. These issues may allow remote attackers to carry out HTML injection, cross-site scripting and SQL injection attacks. This may...

eTicket 1.5.5.2 admin.php CSRF

No description provided by source. source: http://www.securityfocus.com/bid/27173/info eTicket is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues, a cross-site...

eTicket 1.5.5.2 admin.php Multiple Parameter SQL Injection

No description provided by source. source: http://www.securityfocus.com/bid/27173/info eTicket is prone to multiple input-validation vulnerabilities because the application fails to properly sanitize user-supplied input. These vulnerabilities include multiple SQL-injection issues, a cross-site...

GNU/Gallery <= 1.1.1.0 (admin.php) Local File Inclusion Vulnerability

No description provided by source. --==+================================================================================+==-- --==+ GNU/Gallery = 1.1.1.0 admin.php Local File Inclusion Vulnerability +==-- --==+================================================================================+==--...