WordPress Contus Video Gallery Unauthenticated SQL Injection Scanner

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WordPress Contus Video Gallery Unauthenticated SQL Injection Scanner', 'Description' = %q This module attempts to exploit a UNION-based SQL...

Wordpress contus-video-comments plugin remote file upload vulnerability

WordPress is a suite of blogging platforms developed using the PHP language by the WordPress Software Foundation. contus-video-comments is one of the video comment plugins. A remote file upload vulnerability exists in version v1.0 of the Wordpress contus-video-comments plugin, which can be...

CVE-2016-1000112

Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin...

CVE-2016-1000112

Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin...

Design/Logic Flaw

Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin...

CVE-2016-1000112

Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin...

CVE-2016-1000112

Affected software : WordPress plugin contus-video-comments v1.0. Vulnerability : Unauthenticated remote upload of .jpg files via the contus-video-comments plugin, enabling an attacker to upload arbitrary files. The issue is described consistently across CVE-2016-1000112 entries and CNVD/PATCHSTAC...

CVE-2016-1000112: Improper Limitation of a Pathname to a Restricted Directory

Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin...

PT-2016-4504

Name of the Vulnerable Software and Affected Versions contus-video-comments version 1.0 Description The issue concerns an unauthenticated remote .jpg file upload in the contus-video-comments WordPress plugin. Recommendations For contus-video-comments version 1.0, update to a newer version that...

WordPress Contus Video Comments 1.0 File Upload

Title: Unauthenticated remote .jpg file upload in contus-video-comments v1.0 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2016-06-15 Download Site: https://wordpress.org/plugins/contus-video-comments/ Vendor: https://profiles.wordpress.org/hdflvplayer/ Vendor Notified: 2016-06-16...

Contus Video Comments - Unauthenticated Remote JPG File Upload

The contus-video-comments WordPress plugin was affected by an Unauthenticated Remote JPG File Upload security vulnerability. curl --data @image.jpg "http://www.example.com/wp-content/plugins/contus-video-comments/save.php?id=../image"...

WordPress Contus Video Comments Plugin - Remote File Upload

This plugin is prone to a remote file upload vulnerability, because any user can upload .jpg files to the WordPress installation. Solution Update the plugin...

Contus Video Comments - Unauthenticated Remote JPG File Upload

The contus-video-comments WordPress plugin was affected by an Unauthenticated Remote JPG File Upload security vulnerability. PoC curl --data @image.jpg "http://www.example.com/wp-content/plugins/contus-video-comments/save.php?id=../image"...

Contus HD Video Share (aka HDVideoShare) by Apptha [com_contushdvideoshare], 3.5 and below, Directory Traversal

Contus HD Video Share by Apptha comcontushdvideoshare, 3.5 and below, Directory Traversal...

WordPress Contus HD FLV Player Plugin <= 1.7 - Arbitrary File Upload

This plugin is prone to an arbitrary file upload vulnerability. Solution Update plugin...

WordPress Contus Video Gallery Plugin SQL Injection Vulnerability

WordPress is a content management system developed using PHP language. Contus Video Gallery is a video gallery plugin for WordPress sites. A SQL injection vulnerability exists in Contus Video Gallery 2.7 and earlier versions due to the program failing to properly filter the content of the "vid" G...

CVE-2015-2065

CVE-2015-2065 is a SQL injection vulnerability in the Apptha WordPress Video Gallery (contus-video-gallery) plugin for WordPress, affecting versions before 2.8. The flaw allows remote attackers to execute arbitrary SQL commands via the vid parameter in a rss action to wp-admin/admin-ajax.php. The...

WordPress Contus Video Gallery Unauthenticated SQL Injection Scanner

This module attempts to exploit a UNION-based SQL injection in Contus Video Gallery for Wordpress version 2.7 and likely prior in order if the instance is vulnerable. Module Options msf use auxiliary/scanner/http/wp/contusvideogallerysqli msf undefinedcontusvideogallerysqli show actions...

HDFLVPlayer, 2.0, Directory Traversal

HDFLVPlayer, 2.0, Directory Traversal Contus/apptha developers statement We fixed the directory traversal issue and updated the version with 2.2 UpdateNoticeURL http://www.hdflvplayer.net/hd-flv-player-download.php...

PT-2014-8825

Name of the Vulnerable Software and Affected Versions Apptha WordPress Video Gallery contus-video-gallery plugin version 2.5 Description The issue allows remote authenticated users to inject arbitrary web script or HTML via the videoadssearchQuery parameter to API endpoints such as...