2956 matches found
CVE-2015-8353
Cross-site scripting XSS vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the objectname parameter in a rs-objectroleedit page to wp-admin/admin.php...
PT-2017-7402
Name of the Vulnerable Software and Affected Versions Role Scoper plugin for WordPress versions prior to 1.3.67 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML via the object name parameter in a "rs-object role edit" page to...
CVE-2015-8353: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Role Scoper plugin before 1.3.67 for WordPress allows remote attackers to inject arbitrary web script or HTML via the objectname parameter in a rs-objectroleedit page to wp-admin/admin.php...
PT-2017-12789
Name of the Vulnerable Software and Affected Versions Easy Modal plugin versions prior to 2.1.0 Description The issue concerns SQL injection in the delete action of the Easy Modal plugin, specifically affecting the id, ids, or modal parameter to wp-admin/admin.php. This can be exploited by...
CVE-2017-12948: Improper Neutralization of Input During Web Page Generation
Core\Admin\PFTemplater.php in the PressForward plugin 4.3.0 and earlier for WordPress has XSS in the PATHINFO to wp-admin/admin.php, related to PHPSELF...
CVE-2017-12946: Improper Neutralization of Special Elements used in an SQL Command
classes\controller\admin\modals.php in the Easy Modal plugin before 2.1.0 for WordPress has SQL injection in a delete action with the id, ids, or modal parameter to wp-admin/admin.php, exploitable by administrators...
PT-2017-12791
Name of the Vulnerable Software and Affected Versions PressForward plugin versions 4.3.0 and earlier Description The issue concerns a problem with the PATH INFO to wp-admin/admin.php, related to PHP SELF, allowing for XSS in the CoreAdminPFTemplater.php file. Recommendations For PressForward plug...
PT-2017-12790
Name of the Vulnerable Software and Affected Versions Easy Modal plugin versions prior to 2.1.0 Description The issue concerns SQL injection in the Easy Modal plugin for WordPress. It affects the untrash action and involves the id, ids, or modal parameter to "wp-admin/admin.php". This exploit is...
Theo CMS 2.0 SQL Injection Vulnerability
Exploit for php platform in category web applications ============================================= MGC ALERT 2017-004 - Original release date: July 11, 2017 - Last revised: August 12, 2017 - Discovered by: Manuel GarcAa CA!rdenas - Severity: 7,1/10 CVSS Base Score...
CVE-2017-12068: Improper Neutralization of Input During Web Page Generation
The Event List plugin 0.7.9 for WordPress has XSS in the slug array parameter to wp-admin/admin.php in an eladmincategories deletebulk action...
PT-2017-12333
Name of the Vulnerable Software and Affected Versions Event List plugin version 0.7.9 Description The issue concerns a problem with the slug array parameter in the wp-admin/admin.php endpoint, specifically in the el admin categories delete bulk action, allowing for XSS. Recommendations For Event...
Code injection
In Earcms Ear Music through 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=configupload, and then using user.php/music/add/ to upload the code...
CVE-2017-11756
In Earcms Ear Music through 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=configupload, and then using user.php/music/add/ to upload the code...
PT-2017-12224
Name of the Vulnerable Software and Affected Versions Earcms Ear Music versions prior to 4.1 build 20170710 Description The issue allows remote authenticated users to execute arbitrary PHP code. This can be achieved by modifying the allowable music-upload extensions in admin.php?iframe=config...
CVE-2017-11756: Unrestricted Upload of File with Dangerous Type
In Earcms Ear Music through 4.1 build 20170710, remote authenticated users can execute arbitrary PHP code by changing the allowable music-upload extensions to include .php in addition to .mp3 and .m4a in admin.php?iframe=configupload, and then using user.php/music/add/ to upload the code...
Hashtopus SQL Injection Vulnerability
Hashtopus is a cross-platform client-server tool for distributing hash table tasks between multiple computers. A SQL injection vulnerability exists in Hashtopus version 1.5g. A remote attacker can exploit this vulnerability to execute arbitrary SQL commands with the help of the 'format' parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in Hashtopus 1.5g allows remote attackers to inject arbitrary web script or HTML via the query string to admin.php...
Cross site request forgery (csrf)
Cross-Site Request Forgery CSRF exists in Hashtopus 1.5g via the password parameter to admin.php in an a=config action...