514 matches found
WordPress Core 5.2.3 - Viewing UnauthenticatedPasswordPrivate Posts
WordPress Core 5.2.3 - Viewing UnauthenticatedPasswordPrivate Posts So far we know that adding ?static=1 to a wordpress URL should leak its secret content Here are a few ways to manipulate the returned entries: - order with asc or desc - orderby - m with m=YYYY, m=YYYYMM or m=YYYYMMDD date format...
CVE-2019-15889
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or searchpublishdate parameter...
CVE-2019-15889
Summary: CVE-2019-15889 affects the WordPress Download Manager plugin prior to 2.9.94. The vulnerability is a cross-site scripting (XSS) flaw in the category shortcode feature, exploitable via the orderby or publish_date parameters (e.g., ?orderby=title,publish_date or similar). Impact (as stated...
CVE-2019-15889
The download-manager plugin before 2.9.94 for WordPress has XSS via the category shortcode feature, as demonstrated by the orderby or searchpublishdate parameter...
GHSA-V3VF-2R98-XW8W Exposure of Sensitive Information to an Unauthorized Actor in Apache syncope-cope
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11 and 2.0.x before 2.0.8 can recover sensitive security values using the fiql and orderby parameters...
Apache Syncope 2.0.7 Remote Code Execution Exploit
Exploit for windows platform in category remote exploits Exploit Title: Apache Syncope 2.0.7 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://syncope.apache.org/ Software Link: http://archive.apache.org/dist/syncope/ Version: 2.0.7 Tested on: Windows...
Apache Syncope 2.0.7 - Remote Code Execution
Exploit Title: Apache Syncope 2.0.7 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://syncope.apache.org/ Software Link: http://archive.apache.org/dist/syncope/ Version: 2.0.7 Tested on: Windows Advisory: https://syncope.apache.org/security CVE:...
Apache Syncope 2.0.7 - Remote Code Execution
Apache Syncope 2.0.7 - Remote Code Execution Exploit Title: Apache Syncope 2.0.7 - Remote Code Execution Date: 2018-09-12 Exploit Author: Che-Chun Kuo Vendor Homepage: https://syncope.apache.org/ Software Link: http://archive.apache.org/dist/syncope/ Version: 2.0.7 Tested on: Windows Advisory:...
Apache Fineract SQL Injection Vulnerability (CNVD-2018-09808)
Apache Fineract is a set of open source digital financial services platform of the U.S. Apache Apache Software Foundation. The platform can provide users with data management, loan and savings portfolio management and real-time financial data and other functions. An SQL injection vulnerability...
Apache Syncope Information Disclosure Vulnerability
Apache Syncope is the United States Apache Apache Software Foundation's set of open source digital identity management system for use in enterprise environments. The system supports identity management, role configuration and more. A security vulnerability exists in Apache Syncope versions 1.2.x...
CVE-2018-1322
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...
CVE-2018-1322
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...
CVE-2018-1322
An administrator with user search entitlements in Apache Syncope 1.2.x before 1.2.11, 2.0.x before 2.0.8, and unsupported releases 1.0.x and 1.1.x which may be also affected, can recover sensitive security values using the fiql and orderby parameters...
SQL Injection Vulnerability in iCMS v7.0.7 keywords.admincp.php Page
iCMS is a free, clean, efficient, and useful PHP content management system. A SQL injection vulnerability exists in the iCMS v7.0.7 keywords.admincp.php page. The vulnerability stems from the orderby parameter being brought into the database for execution without any processing. An attacker can...
SQL Injection Vulnerability in iCMS v7.0.7 search.admincp.php Page
iCMS is a free, clean, efficient, and useful PHP content management system. iCMS v7.0.7 suffers from a SQL injection vulnerability in the search.admincp.php page, which originates from the orderby parameter being brought into the database for execution without any processing. An attacker can...
SQL Injection Vulnerability in iCMS v7.0.7 apps.admincp.php Page
iCMS is a free, clean, efficient, and useful PHP content management system. iCMS v7.0.7 has a SQL injection vulnerability in the apps.admincp.php page. The vulnerability stems from the orderby parameter being brought into the database for execution without any processing. An attacker can exploit...
CVE-2017-16864
The issue search resource in Atlassian Jira before version 7.4.2 allows remote attackers to inject arbitrary HTML or JavaScript via a cross site scripting XSS vulnerability in the orderby parameter...
WordPress Podlove Podcast Publisher SQL Injection Vulnerability
WordPress Podlove Podcast Publisher is a workflow-oriented solution for podcasters who want to save time and gain complete control over the integrity of their Podcast publishing process, published content, and published content. A SQL injection vulnerability exists in the orderby parameter in...
SQL Injection Vulnerability in Zendo 9.1.2 zentao\lib\base\dao\dao.class.php Page
Zendo is an open source project management software. Zendo project management software version 9.1.2 zentao\lib\base\dao\dao.class.php page SQL injection vulnerability. The orderBy function fails to filter the data submitted by the user, allowing an attacker to exploit the vulnerability to obtain...