1367 matches found
CVE-2014-6315
Multiple cross-site scripting XSS vulnerabilities in the Web-Dorado Photo Gallery plugin 1.1.30 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 callback, 2 dir, or 3 extensions parameter in an addImages action to wp-admin/admin-ajax.php...
OpenSIS ajax.php modname Code Execution (CVE-2013-1349)
A remote code execution vulnerability has been reported in OpenSIS. The vulnerability is due to insufficient validation of modname parameter while parsing requests to ajax.php module. A remote attacker can exploit this vulnerability by sending a specially crafted request to the vulnerable server...
CVE-2014-7152
Cross-site scripting XSS vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the updateoptions action to wp-admin/admin-ajax.php...
Cross site scripting
Cross-site scripting XSS vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the updateoptions action to wp-admin/admin-ajax.php...
CVE-2014-7152
Cross-site scripting XSS vulnerability in the Easy MailChimp Forms plugin 3.0 through 5.0.6 for WordPress allows remote attackers to inject arbitrary web script or HTML via the updateoptions action to wp-admin/admin-ajax.php...
Nokia Web Security Bug Reward: Directory Traversal / Local File inclusion Vulnerability
Little Insight: Well this is my first Directory Traversal Vulnerability / Local File inclusion Vulnerability which I spotted in http://conversations.nokia.com Report Date : 5th march 2014 Reward For Directory Traversal Vulnerability : Nokia Lumia 925Phone How This Work when i was testing it was...
WordPress Theme Forall Arbitrary File Download Vulnerability
WordPress Theme forall suffers from Arbitrary File Download Vulnerability Exploit : http://127.0.0.1/wp-admin/admin-ajax.php?action=revslidershowimage&img=LFD Google Dork : inurl:wp-content/themes/forall Demo:...
WordPress Theme !LesPaul Arbitrary File Download Vulnerability
Exploit for php platform in category web applications Exploit Title : WordPress Theme !LesPaul Arbitrary File Download Vulnerability Exploit Author : NULLPointer Date : 18/09/2014 Vendor Homepage: http://themes.webmandesign.eu/lespaul/ Version: 1.3 Google Dork : inurl:"/wp-content/themes/lespaul/...
WordPress Theme LaBomba Arbitrary File Download Vulnerability
Exploit for php platform in category web applications Exploit Title : WordPress Theme LaBomba Arbitrary File Download Vulnerability Exploit Author : NULLPointer Date : 17/09/2014 Vendor Homepage : http://themeforest.net/item/labomba-responsive-multipurpose-wordpress-theme/6106367 Version: 1.7...
Wordpress Webcam 2Way Videochat Plagin XSS Vulnerability
The VideoWhisper 2 Way Video Chat is a web based video application designed for instant 1 on 1 private online video conferencing. Exploit Title : Wordpress Plugin Webcam 2Way Videochat XSS Vulnerability Exploit Author : NULLPointer Date : 17/09/2014 Download Link :...
WordPress core theme Arbitrary File Download Vulnerability
Usage Info Download Config From The Target. http://localhost/wp-admin/admin-ajax.php?action=revslidershowimage&img=../wp-config.php Exploit Title: WordPress core theme Arbitrary File Download Vulnerability Date: 2014/09/11 Google Dork : inurl:/wp-content/themes/core/framework/wordpress-importer/...
WordPress Plugin WP to Twitter - Authentication Bypass
WordPress Plugin WP to Twitter - Authentication Bypass source: https://www.securityfocus.com/bid/69741/info WP to Twitter Plugin for WordPress is prone to an authorization-bypass vulnerability. An attacker can exploit this issue to bypass certain security restrictions and perform unauthorized...
Mulitple WordPress Themes (admin-ajax.php, img param) - Arbitrary File Download
No description provided by source. WordPress CuckooTap Theme & eShop Arbitrary File Download Risk: High CWE number: CWE-200 Author: Hugo Santiago Contact: [email protected] Date: 31/08/2014 Vendor Homepage: http://themeforest.net/item/cuckootap-one-page-parallax-wp-theme-plus-eshop/3512405...
Mulitple WordPress Themes - admin-ajax.php?img Arbitrary File Download
Mulitple WordPress Themes - admin-ajax.php?img Arbitrary File Download WordPress CuckooTap Theme & eShop Arbitrary File Download Risk: High CWE number: CWE-200 Author: Hugo Santiago Contact: [email protected] Date: 31/08/2014 Vendor Homepage:...
Mulitple WordPress Themes - 'admin-ajax.php?img' Arbitrary File Download
WordPress CuckooTap Theme & eShop Arbitrary File Download Risk: High CWE number: CWE-200 Author: Hugo Santiago Contact: [email protected] Date: 31/08/2014 Vendor Homepage: http://themeforest.net/item/cuckootap-one-page-parallax-wp-theme-plus-eshop/3512405 Tested on: Windows 7 and Gnu/Linux...
Sql injection
SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a goviewobject action to wp-admin/admin-ajax.php...
Starbox Voting - ajax.php Full Path Disclosure
The Starbox Voting WordPress plugin was affected by an ajax.php Full Path Disclosure security vulnerability...
NextGEN Gallery <= 1.7.3 - xml/ajax.php Path Disclosure
The WordPress Gallery Plugin – NextGEN Gallery WordPress plugin was affected by a xml/ajax.php Path Disclosure security vulnerability...