CVE-2013-5739: Improper Neutralization of Input During Web Page Generation

The default configuration of WordPress before 3.6.1 does not prevent uploads of .swf and .exe files, which might make it easier for remote authenticated users to conduct cross-site scripting XSS attacks via a crafted file, related to the getallowedmimetypes function in wp-includes/functions.php...

CVE-2013-5738: Improper Input Validation

The getallowedmimetypes function in wp-includes/functions.php in WordPress before 3.6.1 does not require the unfilteredhtml capability for uploads of .htm and .html files, which might make it easier for remote authenticated users to conduct cross-site scripting XSS attacks via a crafted file...

PT-2013-4960

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.6.1 Description The issue arises from improper determination of serialized data in wp-includes/functions.php, allowing remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations...

PT-2013-5761

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 3.6.1 Description The issue concerns the default configuration, which does not prevent uploads of certain file types, potentially making it easier for remote authenticated users to conduct cross-site scripting XSS...

CVE-2013-4338: Improper Control of Generation of Code

wp-includes/functions.php in WordPress before 3.6.1 does not properly determine whether data has been serialized, which allows remote attackers to execute arbitrary code by triggering erroneous PHP unserialize operations...

CVE-2012-5914: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the sedimport function in system/functions.php in Neocrome Seditio build 160 and 161 allow remote attackers to inject arbitrary web script or HTML via the 1 newmsg or 2 rtext parameter. NOTE: some of these details are obtained from third party...

PT-2012-5711

Name of the Vulnerable Software and Affected Versions RivetTracker versions 1.03 and earlier Description The issue is related to the torrent functions.php file, which does not properly restrict access. This allows remote attackers to have an unspecified impact. Recommendations For RivetTracker...

PT-2012-5714

Name of the Vulnerable Software and Affected Versions RivetTracker versions 1.03 and earlier Description The issue allows remote attackers to execute arbitrary SQL commands. This can be achieved via the hash parameter to specific API endpoints, such as "dltorrent.php" or "torrent functions.php"...

MaxForum v1.0.0 Local File Inclusion Vulnerability

Exploit for php platform in category web applications +---------------------------------------+ | MaxForum v1.0.0 Local File Inclusion | +---------------------------------------+ Author.............: ahwak2000 Mail...............: z.u5athotmaildotcom Software link......: http://www.max4dev.com/...

MaxForum 1.0.0 - Local File Inclusion

+---------------------------------------+ | MaxForum v1.0.0 Local File Inclusion | +---------------------------------------+ Author.............: ahwak2000 Mail...............: z.u5athotmaildotcom Software link......: http://www.max4dev.com/ Tested versions....: 1.0 Dork...............: Powered b...

WordPress <=3.4.1 registration-functions.php绝对路径泄露漏洞

No description provided by source...

CVE-2012-3805

Multiple cross-site scripting XSS vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 absendername, 2 absenderemail, or 3 absendernachricht parameter to the content page; 4...

CVE-2012-3805: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the getAllPassedParams function in system/functions.php in Kajona before 3.4.2 allow remote attackers to inject arbitrary web script or HTML via the 1 absendername, 2 absenderemail, or 3 absendernachricht parameter to the content page; 4...

phpldapadmin 1.2.1.1 lib-functions.php 代码执行漏洞

No description provided by source...

PhpTSMadmin 0.7.0 (functions.php) Remote Code Execution

Exploit for php platform in category web applications ?php / +------------------------------------------------------------------+ + PhpTSMadmin 0.7.0 functions.php Remote Code Execution + +------------------------------------------------------------------+ Web-App : PhpTSMadmin 0.7.0 Vendor :...

CVE-2011-5061: Improper Control of Generation of Code

functions.php in WHMCompleteSolution WHMCS 4.0.x through 5.0.x allows remote attackers to trigger arbitrary code execution in the Smarty templating system by submitting a crafted ticket, related to improper handling of characters in the subject field...

CVE-2011-5026

Cross-site scripting XSS vulnerability in the addPost function in data/functions.php in Winn GuestBook before 2.4.8d allows remote attackers to inject arbitrary web script or HTML via the name parameter to index.php. NOTE: some of these details are obtained from third party information...

CVE-2011-4075: Improper Control of Generation of Code

The masort function in lib/functions.php in phpLDAPadmin 1.2.x before 1.2.2 allows remote attackers to execute arbitrary PHP code via the orderby parameter aka sortby variable in a queryengine action to cmd.php, as exploited in the wild in October 2011...

fims File Management System 1.2.1a - Multiple Vulnerabilities

fims File Management System 1.2.1a - Multiple Vulnerabilities Exploit Title: fims - File Management System execute"select from fimsuser where email='$email' and password=md5'$password'"; if $db-numrows$rs0 return true; else return false; Line 51 of index.php: if isset$REQUESTf...

WordPress Plugin Photo Album Plus 4.1.1 - SQL Injection

WordPress Plugin Photo Album Plus 4.1.1 - SQL Injection Exploit Title: WP Photo Album Plus 1,BENCHMARK500000000,MD5CHAR115,113,108,109,97,112,0&wppa-cover=0&wppa-occur=1 wppa-album=1 AND 1=IF21,BENCHMARK500000000,MD5CHAR115,113,108,109,97,112,0&wppa-cover=0&wppa-occur=1 e.g. wget...