CVE-2017-14766: Improper Authentication

The Simple Student Result plugin before 1.6.4 for WordPress has an Authentication Bypass vulnerability because the fnssraddstsubmit function and fnssrdelstsubmit function in functions.php only require knowing the student id number...

PT-2017-13680

Name of the Vulnerable Software and Affected Versions Simple Student Result plugin versions prior to 1.6.4 Description The issue allows for an authentication bypass because the fn ssr add st submit and fn ssr del st submit functions in functions.php only require knowledge of the student id number...

PT-2017-18108

Name of the Vulnerable Software and Affected Versions GetSimple CMS version 3.3.13 Description The issue concerns poor cryptographic salt initialization, which can be exploited by a network attacker to escalate privileges to an arbitrary user or conduct CSRF attacks. This is achieved through the...

PT-2017-17905

Name of the Vulnerable Software and Affected Versions Spider Event Calendar plugin versions prior to 1.5.52 Description The issue is related to SQL injection in the Spider Event Calendar plugin for WordPress. It is exploitable through the order by parameter in files such as "calendar functions.ph...

PT-2017-16887

Name of the Vulnerable Software and Affected Versions EyesOfNetwork versions 5.0 and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This can be achieved via several parameters to specific API endpoints, including bp name, display, search, or...

PT-2017-16886

Name of the Vulnerable Software and Affected Versions EyesOfNetwork versions 5.0 and earlier Description The issue allows remote authenticated users to execute arbitrary code via shell metacharacters in the selected events parameter. This can occur in the acknowledge, delete, or ownDisown functio...

CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

CVE-2017-5493

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

PT-2017-16534

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.7.1 Description The issue concerns the Multisite WordPress API, where the wp-includes/ms-functions.php file does not properly generate random numbers for keys. This weakness allows remote attackers to bypass...

CVE-2017-5493: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG)

wp-includes/ms-functions.php in the Multisite WordPress API in WordPress before 4.7.1 does not properly choose random numbers for keys, which makes it easier for remote attackers to bypass intended access restrictions via a crafted 1 site signup or 2 user signup...

WordPress functions.php theme file Backdoor vulnerability

No description provided by source...

PT-2015-7380

Name of the Vulnerable Software and Affected Versions SecureMoz Security Audit plugin version 1.0.5 and earlier Description The issue concerns the tweet info function in the class/ functions.php file, which does not utilize an HTTPS session for downloading serialized data. This oversight allows...

CVE-2015-4454

SQL injection vulnerability in the gethashgraphtemplate function in lib/functions.php in Cacti before 0.8.8d allows remote attackers to execute arbitrary SQL commands via the graphtemplateid parameter to graphtemplates.php...

Easy2Map Photos <= 1.0.9 - SQL Injection

The code in Functions.php is vulnerable to SQL Injection because they are not parameterising or sanitising user input. PoC sqlmap -u 'http://www.example.com/wp-admin/admin-ajax.php' --data="mapID=11='+or+1%3D%3D1%3B=e2mimgsavemapname" --cookie=COOKIEHERE --level=5 --risk=3...

CVE-2015-2194: Undefined Security Weakness

Unrestricted file upload vulnerability in the fusionoptions function in functions.php in the Fusion theme 3.1 for Wordpress allows remote authenticated users to execute arbitrary code by uploading a file with an executable extension in a fusionsave action, then accessing it via unspecified vector...

MyBB 1.6.x < 1.6.11 Multiple Vulnerabilities

Binary data 8613.prm...

Empirebak /class/functions.php 代码执行漏洞

No description provided by source...

PT-2015-3614

Name of the Vulnerable Software and Affected Versions Joomlaskin JS Multi Hotel plugin versions 2.2.1 and earlier Description The issue allows remote attackers to obtain the installation path via a request to several API endpoints, including "functions.php", "myCalendar.php", "refreshDate.php",...