CVE-2013-3727: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in Kasseler CMS before 2 r1232 allows remote authenticated users to execute arbitrary SQL commands via the groups parameter to admin.php. NOTE: this can be leveraged using CSRF to allow remote unauthenticated attackers to execute arbitrary SQL commands...

PT-2014-2707

Name of the Vulnerable Software and Affected Versions Kasseler CMS versions prior to 2 r1232 Description The issue allows remote attackers to hijack the authentication of administrators for requests that conduct SQL injection attacks. This can be achieved via the groups parameter in a send action...

PT-2014-2705

Name of the Vulnerable Software and Affected Versions Kasseler CMS versions prior to 2 r1232 Description The issue allows remote authenticated users to execute arbitrary SQL commands via the groups parameter to "admin.php". This can be leveraged using CSRF to allow remote unauthenticated attacker...

PT-2014-2706

Name of the Vulnerable Software and Affected Versions Kasseler CMS versions prior to 2 r1232 Description The issue allows remote authenticated users with permissions to create categories to inject arbitrary web script or HTML via the cat parameter in an "admin new category" action to "admin.php"...

OpenSupports Remote Shell Upload Vulnerability

Sites powered by OpenSupports suffer from a remote shell upload vulnerability. Exploit Title: Open Support Arbitrary Remote File Upload Vulnerabilities Google Dork: allintext: "Power by OpenSupports © 2009 - 2014. All Rights reserved" Date: 02,March 02,2014 Exploit Author: Slotleet Vendor Homepag...

Singapore 0.9.9b / 0.9.10 Cross Site Scripting

Author: TUNISIAN CYBER + Exploit Title: singapore v0.9.9b/0.9.10 admin.php POST Cross Site Scripting Vulnerability + Date: 05-02-2014 + Category: WebApp + Google Dork: : + Tested on: KaliLinux + Vendor: http://sourceforge.net/projects/singapore/ + Friendly Sites: na3il.com,th3-creative.com...

PT-2014-2506

Name of the Vulnerable Software and Affected Versions LeagueManager plugin versions prior to 3.8.1 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the league id parameter in the "leaguemanager-export" page to "wp-admin/admin.php"...

Cross site scripting

Cross-site scripting XSS vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php...

CVE-2012-6622

Multiple cross-site scripting XSS vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in an editgroup action or 2 usergroupid parameter in an...

CVE-2012-6625

CVE-2012-6625 affects the ForumPress WP Forum Server plugin for WordPress, specifically the fs-admin/fs-admin.php component. The vulnerability is a SQL injection via the groupid parameter in an editgroup action, exploitable remotely and leading to arbitrary SQL execution. It applies to plugin ver...

CVE-2012-6623

Cross-site scripting XSS vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php...

CVE-2012-6625: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the groupid parameter in an editgroup action...

CVE-2012-6622: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 groupid parameter in an editgroup action or 2 usergroupid parameter in an...

PT-2014-2392

Name of the Vulnerable Software and Affected Versions ForumPress WP Forum Server plugin versions prior to 1.7.5 Description The issue is related to a cross-site scripting XSS vulnerability. It allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an 'addforum...

CVE-2013-6797

Cross-site request forgery CSRF vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bwurl parameter in the bw-videos pag...

CVE-2013-6797

CVE-2013-6797 is a CSRF vulnerability in the WordPress plugin Blue Wrench Video Widget (bluewrench-video-widget.php) prior to version 2.0.0 . The issue allows remote attackers to hijack an administrator’s session by crafting requests that embed arbitrary URLs via the bw_url parameter on the bw-vi...

CVE-2013-6797: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in bluewrench-video-widget.php in the Blue Wrench Video Widget plugin before 2.0.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bwurl parameter in the bw-videos pag...

PT-2013-6114

Name of the Vulnerable Software and Affected Versions Blue Wrench Video Widget plugin versions prior to 2.0.0 Description A cross-site request forgery CSRF issue allows remote attackers to hijack the authentication of administrators for requests that embed arbitrary URLs via the bw url parameter ...

CVE-2013-5977

Cross-site request forgery CSRF vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that 1 create or modify products or conduct cross-site scripting XSS attacks via the 2...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that 1 create or modify products or conduct cross-site scripting XSS attacks via the 2...