1367 matches found
WordPress Plugin Webdorado Spider Event Calendar 1.4.9 - SQL Injection
. Exploit Title: WordPress: Webdorado Spider Event Calendar = 1.4.9 SQL Injection Date: 2015-02-12 Exploit Author: Mateusz Lach Vendor Homepage: https://www.facebook.com/WebDorado or http://www.webdorado.com Software Link: https://downloads.wordpress.org/plugin/spider-event-calendar.1.4.9.zip...
CVE-2015-1582
Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Spider Facebook plugin before 1.0.11 for WordPress allow 1 remote attackers to inject arbitrary web script or HTML via the appid parameter in a registration task to the default URI or remote administrators to inject arbitrary web script or...
CVE-2015-1579
CVE-2015-1579 describes a directory traversal in the WordPress Slider Revolution plugin (revslider) prior to version 4.2. An attacker can cause read of arbitrary server files by supplying a .. sequence in the img parameter to the revslider_show_image action via wp-admin/admin-ajax.php. This affec...
Wordpress Video Gallery <= 2.7 - SQL Injection
The contus-video-gallery WordPress plugin was affected by a SQL Injection security vulnerability. http://example.com/wp-admin/admin-ajax.php?action=rss&type=video&vid=SQLi...
Sql injection
Multiple SQL injection vulnerabilities in FancyFon FAMOC before 3.17.4 allow 1 remote attackers to execute arbitrary SQL commands via the device ID REST parameter PATHINFO to /ajax.php or 2 remote authenticated users to execute arbitrary SQL commands via the order parameter to index.php...
Photo Gallery <= 1.2.8 - Multiple Authenticated Reflected XSS
The Photo Gallery by 10Web – Mobile-Friendly Image Gallery WordPress plugin was affected by a Multiple Authenticated Reflected XSS security vulnerability. /wp-admin/admin-ajax.php?action=addImages&width=700&height=550&extensions=jpg,jpeg,png,gif&callback=bwgaddpreviewimage&sortby=name";alert1...
Wordpress Theme Avada Arbitrary File Download Vulnerability
Exploit for php platform in category web applications Exploit Title: Wordpress Theme Avada Arbitrary File Download Vulnerability Date: 19/01/2014 Exploit Author: Vylegzhanin Contact : email protected Tested on: Linux / Window Google Dork: inurl:wp-content/themes/avada PoC...
Wordpress Theme Pindol Arbitrary File Download Vulnerability
Exploit for php platform in category web applications Exploit Title: Wordpress Theme Pindol Arbitrary File Download Vulnerability Date: 18/01/2015 Exploit Author: t3rr0rist from GHC Georgian Hacking Community Contact : email protected Tested on: Linux Google Dork: inurl:"wp-content/themes/pindol/...
WordPress Photo Gallery Plugin <= 1.2.7 - SQL Injection
Because of this vulnerability, attackers to execute arbitrary SQL commands via the "orderby parameter" in a GalleryBox action to wp-admin/admin-ajax.php. Solution Update the plugin...
cmseay存储型跨站xss
简要描述： 绕过防护 详细说明： /bbs/ajax.php 19行 $data'username' = isset$COOKIE'username' ? $COOKIE'username' : ''; 无过滤。。 漏洞证明： ./bbs/360safe.php $cookiefilter = "\band|or\b.1,6?=|| 回复之后...
CVE-2014-10016
Multiple cross-site scripting XSS vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via 1 unspecified vectors related to purchaselimit or the 2 name, 3 intl, 4 nocod, or 5 time parameter in an adddeliverymethod acti...
Cross site scripting
Multiple cross-site scripting XSS vulnerabilities in the Welcart e-Commerce plugin 1.3.12 for WordPress allow remote attackers to inject arbitrary web script or HTML via 1 unspecified vectors related to purchaselimit or the 2 name, 3 intl, 4 nocod, or 5 time parameter in an adddeliverymethod acti...
WordPress Welcart e-Commerce Plugin <= 1.3.12 - Multiple XSS
Because of these vulnerabilities, the attackers can inject arbitrary web script or HTML in an adddeliverymethod action to wp-admin/admin-ajax.php via 4 parameters: "name", "intl", "nocod", or "time parameter". Solution Update the plugin...
Osclass 'ajax.php' local file inclusion vulnerability
OSClass is a PHP MySQL based development , used to create and manage classified ads website open source system . A local file inclusion vulnerability exists in Osclass 'ajax.php' because it fails to adequately filter user-supplied input. An attacker can exploit this vulnerability to obtain...
CVE-2014-9461
Directory traversal vulnerability in models/Cart66.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to read arbitrary files via a .. dot dot in the memberdownload action to wp-admin/admin-ajax.php...
CVE-2014-9441
Multiple cross-site request forgery CSRF vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct cross-site scripting XSS attacks via...
Cross site request forgery (csrf)
Multiple cross-site request forgery CSRF vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct cross-site scripting XSS attacks via...
Sql injection
SQL injection vulnerability in models/Cart66Ajax.php in the Cart66 Lite plugin before 1.5.4 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the q parameter in a promotionProductSearch action to wp-admin/admin-ajax.php...
CVE-2014-9441
Multiple cross-site request forgery CSRF vulnerabilities in the Lightbox Photo Gallery plugin 1.0 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 change plugin settings via unspecified vectors or conduct cross-site scripting XSS attacks via...