WordPress Sintic Gallery Plugin - Full Path Disclosure

This plugin is prone to a full path disclosure vulnerability. Solution Update plugin...

WordPress SpamFree Plugin <= 1.9.2 - Full Path Disclosure

This plugin is prone to a multiple script direct request path disclosure. Solution Upgrade the plugin...

WordPress Random Image Widget Plugin - Full Path Disclosure

This plugin is prone to a full path disclosure vulnerability. Solution Update plugin...

WordPress RokStories Plugin <= 1.25 - Multiple Vulnerabilities

This plugin is prone to cross site scripting, denial of service, full path disclosure and arbitrary file upload vulnerabilities. Solution Update plugin...

WordPress LBG Zoominoutslider Plugin - Full Path Disclosure

This plugin is prone to a multiple script direct request path disclosure. Solution Upgrade the plugin...

WordPress Mingle Forum Plugin <= 1.0.28 - Multiple Vulnerabilities

This plugin is prone to cross site scripting and full path disclosure vulnerabilities. Solution Update plugin...

WordPress Exploit Scanner Plugin <= 1.3.3 - Multiple Vulnerabilities

This plugin is prone to a full path disclosure and security bypass vulnerabilities. Attackers can inject PHP backdoor into web site or execute OS commands. Solution Update the plugin...

WordPress RokBox Plugin <= 2.13 - Multiple Vulnerabilities

This plugin is prone to multiple vulnerabilities: 1. Path Disclosure via thumb.php "src" parameter. 2. Cross site scripting in thumb.php "src" parameter. 3. Direct request path disclosure in rokbox.php. 4. Arbitrary file upload via thumb.php "src" parameter. 5. Direct request error log informatio...

WordPress NextGEN Gallery Plugin <= 1.7.3 - Full Path Disclosure

This plugin is prone to xml/ajax.php full path disclosure vulnerability. Solution Update the plugin...

WordPress Jigoshop Plugin <= 1.8 - Full Path Disclosure

This plugin is prone to a multiple script direct request path disclosure. Solution Upgrade the plugin...

WordPress JS Multi Hotel Plugin <= 2.2.1 - Full Path Disclosure

This plugin is prone to a full path disclosure vulnerability in includes/timthumb.php src parameter. Solution Update the plugin...

WordPress Random Image Widget Plugin - Full Path Disclosure

This plugin is prone to a full path disclosure vulnerability. Solution Update plugin...

WordPress I Love It Theme - Multiple Vulnerabilities

All version of this theme are prone to a cross site scripting, content spoofing and path disclosure vulnerabilities. Solution There is no solution...

WordPress RokIntroScroller Plugin <= 1.8 - Multiple Vulnerabilities

This plugin is prone to cross site scripting, denial of service, full path disclosure and arbitrary file upload vulnerabilities. Solution Update plugin...

WordPress RokMicroNews Plugin <= 1.5 - Multiple Vulnerabilities

This plugin is prone to cross site scripting, denial of service, full path disclosure and arbitrary file upload vulnerabilities. Solution Update plugin...

Arbitrary Variable Overwrite in eShop WordPress Plugin

Advisory ID: HTB23255 Product: eShop WordPress plugin Vendor: Rich Pedley Vulnerable Versions: 6.3.11 and probably prior Tested Version: 6.3.11 Advisory Publication: April 15, 2015 without technical details Vendor Notification: April 15, 2015 Public Disclosure: May 6, 2015 Vulnerability Type: Cod...

n2cms 2.2.1 Path Disclosure

Affected software: n2cms Type of vulnerability:full path disclosure URL:n2cms.com Discovered by: provensec Website: provensec.com version: 2.2.1 Proof of concept http://demo.n2cms.com/N2/Files/FileSystem/File.aspx?selected=%2fupload%2f%22%3E%3Cimg%20src=d%20onerror=confirm1;%3E1.php%2f manipulati...

WordPress eShop 6.3.11 Code Execution Exploit

High-Tech Bridge Security Research Lab discovered a security vulnerability in the eShop WordPress Plugin, which can be exploited by remote attackers to overwrite arbitrary PHP variables within the context of the vulnerable application. The vulnerability exists due to insufficient validation of...

Nodes Studio CMS XSS / Path Disclosure / SQL Injection

Hello list! There are SQL Injection, Cross-Site Scripting and Full Path Disclosure vulnerabilities in Nodes Studio CMS. This is Russian commercial CMS, which I found at one site of Russian terrorists and propagandists. ------------------------- Affected vendors: ------------------------- Nodes...

Arbitrary Variable Overwrite in eShop WordPress Plugin

High-Tech Bridge Security Research Lab discovered security vulnerability in eShop WordPress Plugin, which can be exploited by remote attacker to overwrite arbitrary PHP variables within the context of the vulnerable application. The vulnerability exists due to insufficient validation of...