JVN#97971874: Welcart vulnerable to cross-site scripting

Welcart provided by Collne Inc. is a WordPress plugin for creating shopping websites. Welcart contains a cross-site scripting CWE-79 vulnerability due to the processing of uscesreferer parameter in admin.php. Impact If a user views a malicious page while logged into WordPress with this plugin...

JVN#92828286: Welcart vulnerable to SQL injection

Welcart provided by Collne Inc. is a WordPress plugin for creating shopping websites. Welcart contains a SQL injection CWE-89 vulnerability due to the processing of changeSort parameter in admin.php. Impact An attacker that can log in to WordPress with this plugin enabled may obtain or alter...

CVE-2015-4063

Cross-site scripting XSS vulnerability in includes/nspsearch.php in the NewStatPress plugin before 0.9.9 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the where1 parameter in the nspsearch page to wp-admin/admin.php...

WordPress Download Manager Plugin <= 2.2.2 - XSS

This plugin is prone to admin.php cid parameter cross site scripting vulnerability. Solution Update the plugin...

WordPress LeagueManager Plugin <= 3.7 - Cross Site Scripting

This plugin is prone to a wp-admin/admin.php multiple parameter cross site scripting vulnerability. Solution Update the plugin...

Directory traversal

Directory traversal vulnerability in the TheCartPress eCommerce Shopping Cart aka The Professional WordPress eCommerce Plugin plugin for WordPress before 1.3.9.3 allows remote administrators to read arbitrary files via a .. dot dot in the tcpboxpath parameter in the checkouteditorsettings page to...

CVE-2014-9311

CVE-2014-9311 affects the WordPress Shareaholic plugin prior to version 7.6.1.0. The vulnerability is a cross-site scripting (XSS) flaw in admin.php where authenticated users can inject arbitrary script/HTML via the location[id] parameter in the shareaholic_add_location action to wp-admin/admin-a...

WordPress Plugin MiwoFTP 1.0.5 - Multiple Cross-Site Request Forgery Cross-Site Scripting Vulnerabilities

WordPress Plugin MiwoFTP 1.0.5 - Multiple Cross-Site Request Forgery Cross-Site Scripting Vulnerabilities WordPress MiwoFTP Plugin 1.0.5 Multiple CSRF XSS Vulnerabilities Vendor: Miwisoft LLC Product web page: http://www.miwisoft.com Affected version: 1.0.5 Summary: MiwoFTP is a smart, fast and...

CVE-2015-0950

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

CVE-2015-0950

Cross-site scripting XSS vulnerability in admin.php in X-Cart 5.1.6 through 5.1.10 allows remote attackers to inject arbitrary web script or HTML via the substring parameter...

WordPress Simple Ads Manager 2.5.94 / 2.5.96 SQL Injection

Vulnerability title: Wordpress plugin Simple Ads Manager - Multiple SQL Injection Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 and 2.5.96 Download link: https://wordpress.org/plugins/simple-ads-manager/ CV...

Wordpress Simple Ads Manager Plugin - Multiple SQL Injection Vulnerability

Exploit for php platform in category web applications Vulnerability title: Wordpress plugin Simple Ads Manager - SQL Injection Product: Wordpress plugin Simple Ads Manager Vendor: https://profiles.wordpress.org/minimus/ Affected version: Simple Ads Manager 2.5.94 and 2.5.96 Download link:...

精讯CMS SQL注入（通杀）

简要描述： 底层模型解析出错，导致大面积注入。 这是真的注入，真的能注出数据的。 无视新版添加的webscan.class.php 详细说明： 找注入，上来就看sql语句是怎么处理的。 jxcms的model调用数据库操作无论是 -where -find 都会调用/jxcms/lib/core/db.class.php文件中的checkOneWhere函数进行组装与过滤。 private function checkOneWhere$str $tmp = pregreplace'/"|'.?\1/s', '', $str; $tmp = strtoupper$tmp; if...

WordPress Plugin Google Analytics by Yoast 'class-admin.php' HTML Injection Vulnerability

WordPress is a use of PHP language development blog platform, users can support PHP and MySQL database server set up their own weblog. An HTML injection vulnerability exists in the WordPress plugin Google Analytics by Yoast 'class-admin.php'. An attacker can exploit the vulnerability to execute...

Smart PHP Poll - Authentication Bypass

Exploit Title: Smart PHP Poll Auth Bypass Vulnerability Google Dork: Copyright � Smart PHP Poll. All Rights Reserved. Exploit Author: Mr.tro0oqy from Yemen Email : [email protected] Download Script :http://www.scriptsez.net/download/download.php?action=download&p=smartphppoll.zip&ns=1 go to...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the Easy Social Icons plugin before 1.2.3 for WordPress allows remote attackers to hijack the authentication of administrators for requests that conduct cross-site scripting XSS attacks via the imagefile parameter in an edit action in the...

CVE-2015-2083

CVE-2015-2083 describes a Cross-site Request Forgery (CSRF) in Ilch CMS. An attacker can exploit requests to admin.php with a profilefields action to add a value to a profile field, potentially hijacking an administrator’s session/authentication. The vulnerability is documented across multiple so...

Piwigo 'admin.php' SQL Injection Vulnerability

Piwigo is a photo album system based on MySQL5 and PHP5 development. Piwigo 'admin.php' suffers from a SQL injection vulnerability that allows remote attackers to exploit the vulnerability to submit specially crafted SQL queries to manipulate or obtain database data...

Piwigo 'admin.php' Cross-Site Scripting Vulnerability

Piwigo is a photo album script written in PHP. A cross-site scripting vulnerability exists in versions of Piwigo prior to 2.7.4, which allows attackers to launch cross-site scripting attacks...

Cross site scripting

Cross-site scripting XSS vulnerability in the administrative backend in Piwigo before 2.7.4 allows remote attackers to inject arbitrary web script or HTML via the page parameter to admin.php...