CVE-2012-10011: Improper Neutralization of Special Elements used in an SQL Command

A vulnerability was found in HD FLV PLayer Plugin up to 1.7 on WordPress. It has been rated as critical. Affected by this issue is the function hdaddmedia/hdupdatemedia of the file functions.php. The manipulation of the argument name leads to sql injection. The attack may be launched remotely...

CVE-2022-25498

CuppaCMS v1.0 was discovered to contain a remote code execution RCE vulnerability via the saveConfigData function in /classes/ajax/Functions.php...

CVE-2022-25498

CuppaCMS v1.0 was discovered to contain a remote code execution RCE vulnerability via the saveConfigData function in /classes/ajax/Functions.php...

CVE-2022-25498

CuppaCMS v1.0 was discovered to contain a remote code execution RCE vulnerability via the saveConfigData function in /classes/ajax/Functions.php...

CVE-2022-25498

CuppaCMS v1.0 was discovered to contain a remote code execution RCE vulnerability via the saveConfigData function in /classes/ajax/Functions.php...

CVE-2022-25498: Improper Control of Generation of Code

CuppaCMS v1.0 was discovered to contain a remote code execution RCE vulnerability via the saveConfigData function in /classes/ajax/Functions.php...

CVE-2022-24221

eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php...

CVE-2022-24221

eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php...

CVE-2022-24221: Improper Neutralization of Special Elements used in an SQL Command

eliteCMS v1.0 was discovered to contain a SQL injection vulnerability via /admin/functions/functions.php...

PT-2022-16544

Name of the Vulnerable Software and Affected Versions eliteCMS version 1.0 Description The issue is related to a SQL injection vulnerability. It can be exploited via the /admin/functions/functions.php endpoint. Recommendations For eliteCMS version 1.0, consider restricting access to the...

Cross-site Scripting (XSS)

buddyboss-bundler is vulnerable to cross-site scripting. The vulnerability exists due to lack of input validationin in bpregisteractivegrouptypesfunction in bp-groups-functions.php file. allow attacker to inject maliciously crafted script into the system...

CVE-2021-39314 WooCommerce EnvioPack <= 1.2 Reflected Cross-Site Scripting

The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the /includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

CVE-2021-39314: Improper Neutralization of Input During Web Page Generation

The WooCommerce EnvioPack WordPress plugin is vulnerable to Reflected Cross-Site Scripting via the dataid parameter found in the /includes/functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 1.2...

Cross-site Scripting (XSS)

zoneminder is vulnerable to Cross Site Scripting. The vulnerability exists due to a lack of validation of the function sortHeader in functions.php which insecurely returns the value of the limit query string parameter without applying any filtration...

PT-2021-22032

Name of the Vulnerable Software and Affected Versions: The SP Project & Document Manager WordPress plugin versions up to and including 4.25 Description: The issue allows attackers to inject arbitrary web scripts via attribute-based Reflected Cross-Site Scripting. This is possible through the from...

CVE-2021-38315: Improper Neutralization of Input During Web Page Generation

The SP Project & Document Manager WordPress plugin is vulnerable to attribute-based Reflected Cross-Site Scripting via the from and to parameters in the /functions.php file which allows attackers to inject arbitrary web scripts, in versions up to and including 4.25...

CVE-2020-18890

Rmote Code Execution RCE vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicious user getshell via /admin/functions.php...

CVE-2020-18888

Arbitrary File Deletion vulnerability in puppyCMS v5.1 allows remote malicious attackers to delete the file/folder via /admin/functions.php...

CVE-2020-18890

Rmote Code Execution RCE vulnerability in puppyCMS v5.1 due to insecure permissions, which could let a remote malicious user getshell via /admin/functions.php...

CVE-2020-18888: Missing Authorization

Arbitrary File Deletion vulnerability in puppyCMS v5.1 allows remote malicious attackers to delete the file/folder via /admin/functions.php...