PT-2014-8739

Name of the Vulnerable Software and Affected Versions WP Symposium plugin versions prior to 14.11 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved by exploiting the tray parameter in a getMailMessage action within the ajax/mail...

PT-2014-8738

Name of the Vulnerable Software and Affected Versions WP Symposium plugin versions prior to 14.11 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters in different actions, including the text parameter in an "addComment"...

CVE-2014-8799

Directory traversal vulnerability in the dpimgresize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the src parameter to lib/dpimage.php...

CVE-2014-8799: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in the dpimgresize function in php/dp-functions.php in the DukaPress plugin before 2.5.4 for WordPress allows remote attackers to read arbitrary files via a .. dot dot in the src parameter to lib/dpimage.php...

PT-2014-6000

Name of the Vulnerable Software and Affected Versions wp-football plugin version 1.1 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via several parameters and files, including the league parameter to files such as "football...

Sql injection

Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 password, 2 email, or 3 id parameter...

PT-2014-6387

Name of the Vulnerable Software and Affected Versions Pro Chat Rooms Text Chat Rooms version 8.2.0 Description The issue concerns SQL injection vulnerabilities in the includes/functions.php file. Remote authenticated users can execute arbitrary SQL commands by manipulating the password, email, or...

CVE-2014-5275: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 password, 2 email, or 3 id parameter...

Status2k-Server-Monitoring /includes/functions.php 后门

No description provided by source...

PT-2014-6321

Name of the Vulnerable Software and Affected Versions yawpp plugin version 1.2 Description The issue allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands. This can be achieved via vectors related to admin functions.php or admin update.php. For example, t...

Delightful Downloads 1.3.1.1 - includes/functions.php User-Agent HTTP Header Stored XSS

The Delightful Downloads WordPress plugin was affected by an includes/functions.php User-Agent HTTP Header Stored XSS security vulnerability...

VietPHP _functions.php dirpath Parameter Remote File Inclusion

No description provided by source. source: http://www.securityfocus.com/bid/25226/info VietPHP is prone to multiple remote file-include vulnerabilities because it fails to sufficiently sanitize user-supplied data. Exploiting these issues may allow an attacker to compromise the application and the...

Invision Board 1.1.1 functions.php SQL Injection Vulnerability

No description provided by source. source: http://www.securityfocus.com/bid/7290/info An input validation error has been reported in Invision Board which may result in the manipulation of SQL queries. This vulnerability exists in the functions.php script file. An attacker may be able to exploit...

phpBB XS <= 0.58 (functions.php) Remote File Include Vulnerability

No description provided by source. Author: AzzCoder Vendor: http://www.phpbbxs.eu/ Vulnerable File: includes/functions.php Vulnerable Code: //The phpbbrootpath isn't initialize includeonce $phpbbrootpath . './includes/functionscategorieshierarchy.' . $phpEx ; Method To Use:...

phpLDAPadmin <= 1.2.1.1 (query_engine) Remote PHP Code Injection

No description provided by source. $Id: phpldapadminqueryengine.rb 14060 2011-10-25 05:25:39Z sinn3r $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and...

Monster Top List 1.4 Functions.PHP Remote File Include Vulnerability

No description provided by source...

Omegaboard <= 1.0beta4 (functions.php) Remote File Include Vuln

No description provided by source. ----------------------------------------------- Omegaboard v1.0b4 phpbbrootpath Remote File Include Exploit ----------------------------------------------- Author: xoron xoron.biz - xoron.info ----------------------------------------------- Code: includeonce...

phpECard <= 2.1.4 (functions.php) Remote File Include Vulnerability

No description provided by source. ============================================================================================== phpECard functions.php Remote File Inclusion Exploit =============================================================================================== Critical Level :...

WordPress <= 2.8.5 Unrestricted File Upload Arbitrary PHP Code Execution

No description provided by source. ============================================= - Release date: November 11th, 2009 - Discovered by: Dawid Golunski - Severity: Moderately High ============================================= I. VULNERABILITY ------------------------- WordPress = 2.8.5 Unrestricted...

PT-2014-5959

Name of the Vulnerable Software and Affected Versions GEO Redirector plugin versions 1.0.1 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the hid id parameter in the ajax functions.php file. Recommendations For versions 1.0....