CVE-2014-5193: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to inject arbitrary web script or HTML via the category parameter. NOTE: the url parameter vector is already covered by CVE-2014-5082...

CVE-2014-5192: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote attackers to execute arbitrary SQL commands via the filter parameter...

CVE-2014-5194: Improper Control of Generation of Code

Static code injection vulnerability in admin/admin.php in Sphider 1.3.6 allows remote authenticated users to inject arbitrary PHP code into settings/conf.php via the wordupperbound parameter...

Sql injection

SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus simple-retail-menus plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php...

CVE-2014-5180

SQL injection vulnerability in the videos page in the HDW Player Plugin hdw-player-video-player-video-gallery 2.4.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the edit action to wp-admin/admin.php...

CVE-2014-5184

SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the story parameter in an edit action to wp-admin/admin.php...

CVE-2014-5082

Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus allow remote attackers to execute arbitrary SQL commands via the 1 siteid or 2 url parameter...

Sql injection

Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus allow remote attackers to execute arbitrary SQL commands via the 1 siteid or 2 url parameter...

CVE-2014-5082

CVE-2014-5082 relates to multiple SQL injection vulnerabilities in admin/admin.php affecting Sphider 1.3.6 and earlier , including Sphider Pro/Plus . The flaw enables remote attackers to manipulate the underlying database by injecting via the parameters site_id or url , as documented in the CVE e...

PT-2014-6323

Name of the Vulnerable Software and Affected Versions stripShow plugin version 2.5.2 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved by exploiting the story parameter in an edit action to the "wp-admin/admin.php" endpoint...

PT-2014-6322

Name of the Vulnerable Software and Affected Versions Simple Retail Menus plugin versions prior to 4.1 Description The issue allows remote authenticated editors to execute arbitrary SQL commands. This is achieved by exploiting the targetmenu parameter in an edit action to the "wp-admin/admin.php"...

PT-2014-6325

Name of the Vulnerable Software and Affected Versions All Video Gallery plugin version 1.2 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the id parameter in an edit action in the "allvideogallery videos" page to...

PT-2014-6319

Name of the Vulnerable Software and Affected Versions HDW Player Plugin hdw-player-video-player-video-gallery version 2.4.2 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the id parameter in the edit action to...

CVE-2014-5186: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the All Video Gallery all-video-gallery plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogalleryvideos page to wp-admin/admin.php...

CVE-2014-5180: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the videos page in the HDW Player Plugin hdw-player-video-player-video-gallery 2.4.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the edit action to wp-admin/admin.php...

CVE-2014-5184: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the story parameter in an edit action to wp-admin/admin.php...

PT-2014-6270

Name of the Vulnerable Software and Affected Versions Sphider versions 1.3.6 and earlier Sphider Pro affected versions not specified Sphider-plus affected versions not specified Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the site id or ur...

CVE-2014-5183: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus simple-retail-menus plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php...

CVE-2014-5082: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in admin/admin.php in Sphider 1.3.6 and earlier, Sphider Pro, and Sphider-plus allow remote attackers to execute arbitrary SQL commands via the 1 siteid or 2 url parameter...

blogVault 1.05 - admin.php blogVault Key Setting CSRF

The Backup & Staging – BlogVault Backups WordPress plugin was affected by an admin.php blogVault Key Setting CSRF security vulnerability...