502 matches found
WordPress Duplicator 0.5.14 Cross Site Request Forgery / SQL Injection Vulnerabilities
WordPress Duplicator plugin versions 0.5.14 and below suffer from cross site request forgery and remote SQL injection vulnerabilities. Exploit Title : Wordpress Duplicator prefix . 'duplicatorpackages'; $postIDs = isset$post'duplicatordelid' ? $post'duplicatordelid' : null; $list = explode",",...
WordPress Duplicator 0.5.14 Cross Site Request Forgery / SQL Injection
Exploit Title : Wordpress Duplicator prefix . 'duplicatorpackages'; $postIDs = isset$post'duplicatordelid' ? $post'duplicatordelid' : null; $list = explode",", $postIDs; $delCount = 0; if $postIDs != null foreach $list as $id $getResult = $wpdb-getresults"SELECT name, hash FROM $tblName WHERE id...
Duplicator <= 0.5.14 - SQL Injection & CSRF
An authorised user with "export" permission or a remote unauthenticated attacker could use this vulnerability to execute arbitrary SQL queries on the victim WordPress web site by enticing an authenticated admin CSRF. http://www.example.com/wp-admin/admin-ajax.php?action=duplicatorpackagedelete PO...
Duplicator <= 0.5.14 - SQL Injection & CSRF
An authorised user with "export" permission or a remote unauthenticated attacker could use this vulnerability to execute arbitrary SQL queries on the victim WordPress web site by enticing an authenticated admin CSRF. PoC http://www.example.com/wp-admin/admin-ajax.php?action=duplicatorpackagedelet...
Duplicator 0.5.8 - Privilege Escalation
The Duplicator – WordPress Migration Plugin WordPress plugin was affected by a Privilege Escalation security vulnerability...
WordPress Plugin Duplicator 0.5.8 - Privilege Escalation
WordPress Plugin Duplicator 0.5.8 - Privilege Escalation Exploit Title: Duplicator 0.5.8 Privilege Escalation Date: 21-11-2014 Software Link: https://wordpress.org/plugins/duplicator/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/...
WordPress Duplicator 0.5.8 Privilege Escalation Vulnerability
WordPress Duplicator plugin version 0.5.8 suffers from a backup related vulnerability that allows for privilege escalation. Exploit Title: Duplicator 0.5.8 Privilege Escalation Date: 21-11-2014 Software Link: https://wordpress.org/plugins/duplicator/ Exploit Author: Kacper Szurek Contact:...
WordPress Plugin Duplicator 0.5.8 - Privilege Escalation
Exploit Title: Duplicator 0.5.8 Privilege Escalation Date: 21-11-2014 Software Link: https://wordpress.org/plugins/duplicator/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Every registered user can crea...
WordPress Duplicator 0.5.8 Privilege Escalation
Exploit Title: Duplicator 0.5.8 Privilege Escalation Date: 21-11-2014 Software Link: https://wordpress.org/plugins/duplicator/ Exploit Author: Kacper Szurek Contact: http://twitter.com/KacperSzurek Website: http://security.szurek.pl/ Category: webapps 1. Description Every registered user can crea...
Duplicator - installer.cleanup.php package Parameter XSS
The Duplicator – WordPress Migration Plugin WordPress plugin was affected by an installer.cleanup.php package Parameter XSS security vulnerability...
CVE-2013-4625
Cross-site scripting XSS vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter...
Cross site scripting
Cross-site scripting XSS vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter...
CVE-2013-4625
The CVE-2013-4625 entry concerns WordPress Duplicator Plugin (vulnerable up to 0.4.4, fixed in 0.4.5). The vulnerability is an XSS in files/installer.cleanup.php where the package parameter is insufficiently sanitized, allowing remote attackers to inject arbitrary script/HTML. Evidence from multi...
CVE-2013-4625
Cross-site scripting XSS vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter...
CVE-2013-4625: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in files/installer.cleanup.php in the Duplicator plugin before 0.4.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the package parameter...
Cross-Site Scripting (XSS) in Duplicator WordPress Plugin
Advisory ID: HTB23162 Product: Duplicator WordPress Plugin Vendor: LifeInTheGrid Vulnerable Versions: 0.4.4 and probably prior Tested Version: 0.4.4 Vendor Notification: June 19, 2013 Vendor Patch: July 21, 2013 Public Disclosure: July 24, 2013 Vulnerability Type: Cross-Site Scripting CWE-79 CVE...
WordPress Duplicator 0.4.4 Cross Site Scripting
No description provided by source. Advisory ID: HTB23162 Product: Duplicator WordPress Plugin Vendor: LifeInTheGrid Vulnerable Versions: 0.4.4 and probably prior Tested Version: 0.4.4 Vendor Notification: June 19, 2013 Vendor Patch: July 21, 2013 Public Disclosure: July 24, 2013 Vulnerability Typ...
WordPress Plugin Duplicator - Cross-Site Scripting
WordPress Plugin Duplicator - Cross-Site Scripting source: https://www.securityfocus.com/bid/61425/info The Duplicator plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute...
WordPress Duplicator Plugin - Cross Site Scripting
WordPress Duplicator plugin is prone to a cross-site scripting vulnerability. It fails to properly clean up user-supplied input. An attacker may execute arbitrary script code in the browser of an user in the context of the affected site. In this way the attacker can steal cookie-based...
WordPress Plugin Duplicator - Cross-Site Scripting
source: https://www.securityfocus.com/bid/61425/info The Duplicator plugin for WordPress is prone to a cross-site-scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecti...