1610 matches found
CVE-2014-4514: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in includes/apitenpay/inc.tenpaynotify.php in the Alipay plugin 3.6.0 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via vectors related to the getDebugInfo function...
PT-2014-6387
Name of the Vulnerable Software and Affected Versions Pro Chat Rooms Text Chat Rooms version 8.2.0 Description The issue concerns SQL injection vulnerabilities in the includes/functions.php file. Remote authenticated users can execute arbitrary SQL commands by manipulating the password, email, or...
CVE-2014-5275: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in includes/functions.php in Pro Chat Rooms Text Chat Rooms 8.2.0 allow remote authenticated users to execute arbitrary SQL commands via the 1 password, 2 email, or 3 id parameter...
PT-2014-4436
Name of the Vulnerable Software and Affected Versions vBulletin versions 4.2.2, 4.2.1, 4.2.0 PL2, and earlier Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the conceptid argument in an xmlrpc API request to the...
PT-2014-7221
Name of the Vulnerable Software and Affected Versions Contact Form 7 Integrations plugin versions 1.0 through 1.3.10 Description The issue allows remote attackers to inject arbitrary web script or HTML via the uE or uC parameters in the includes/toAdmin.php file. This can lead to cross-site...
CVE-2014-6445: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in includes/toAdmin.php in Contact Form 7 Integrations plugin 1.0 through 1.3.10 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 uE or 2 uC parameter...
CVE-2014-5241
The JSONP endpoint in includes/api/ApiFormatJson.php in MediaWiki before 1.19.18, 1.20.x through 1.22.x before 1.22.9, and 1.23.x before 1.23.2 accepts certain long callback values and does not restrict the initial bytes of a JSONP response, which allows remote attackers to conduct cross-site...
CVE-2014-0232: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a 1...
CVE-2014-5203
CVE-2014-5203 affects WordPress 3.9.x before 3.9.2, where the widget implementation in wp-includes/class-wp-customize-widgets.php can be triggered to execute arbitrary code via crafted serialized data. The NVD/NVИ records show a high severity (base score 7.5) with network exploitability and no au...
CVE-2014-5240
Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...
CVE-2014-5204
wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack...
CVE-2014-5204: Cross-Site Request Forgery (CSRF)
wp-includes/pluggable.php in WordPress before 3.9.2 rejects invalid CSRF nonces with a different timing depending on which characters in the nonce are incorrect, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack...
CVE-2014-5203: Undefined Security Weakness
wp-includes/class-wp-customize-widgets.php in the widget implementation in WordPress 3.9.x before 3.9.2 might allow remote attackers to execute arbitrary code via crafted serialized data...
CVE-2014-5205: Cross-Site Request Forgery (CSRF)
wp-includes/pluggable.php in WordPress before 3.9.2 does not use delimiters during concatenation of action values and uid values in CSRF tokens, which makes it easier for remote attackers to bypass a CSRF protection mechanism via a brute-force attack...
CVE-2014-5240: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in wp-includes/pluggable.php in WordPress before 3.9.2, when Multisite is enabled, allows remote authenticated administrators to inject arbitrary web script or HTML, and obtain Super Admin privileges, via a crafted avatar URL...
PT-2014-6359
Name of the Vulnerable Software and Affected Versions MediaWiki versions prior to 1.19.18 MediaWiki versions 1.20.x through 1.22.x before 1.22.9 MediaWiki versions 1.23.x before 1.23.2 Description The issue concerns the JSONP endpoint in MediaWiki, which does not properly restrict certain long...
Delightful Downloads 1.3.1.1 - includes/functions.php User-Agent HTTP Header Stored XSS
The Delightful Downloads WordPress plugin was affected by an includes/functions.php User-Agent HTTP Header Stored XSS security vulnerability...
JS MultiHotel 2.2.1 - includes/delete_img.php path Parameter Reflected XSS
The js-multihotel WordPress plugin was affected by an includes/deleteimg.php path Parameter Reflected XSS security vulnerability...