Subrion Cross-Site Request Forgery Vulnerability

Subrion is a powerful and easy-to-use PHP content management system CMS with full source editing, per-page permissions, user activity monitoring and other powerful features. A cross-site request forgery vulnerability exists in panel/modules/plugins/ in Subrion 4.2.1. An attacker can exploit this...

CMP - Coming Soon & Maintenance < 3.8.2 - Improper Access Controls on AJAX Calls

Some of the AJAX calls from the plugin do not properly check for capabilities and CSRF tokens, leading to issues such as arbitrary post read, subscribers list export and plugin deactivation...

WordPress CMP – Coming Soon & Maintenance plugin <= 3.8.1 - Unauthenticated Plugin Deactivation vulnerability

Unauthenticated Plugin Deactivation vulnerability discovered by NinTechNet in WordPress CMP – Coming Soon & Maintenance plugin versions = 3.8.1. Solution Update the WordPress CMP – Coming Soon & Maintenance plugin to the latest available version at least 3.8.2...

2J SlideShow < 1.3.40 - Authenticated Arbitrary Plugin Deactivation

Description Lack of authorisation checks in the twojslideshowsetup function registered as an AJAX call could allow authenticated users with low privileges to deactivate arbitrary plugins...

WordPress Images Slideshow by 2J plugin <= 1.3.31 - Authenticated Arbitrary Plugin Deactivation vulnerability

Authenticated Arbitrary Plugin Deactivation vulnerability discovered by NinTechNet in WordPress Images Slideshow by 2J plugin versions = 1.3.31. Solution Update the WordPress Images Slideshow by 2J plugin to the latest available version at least 1.3.33...

WordPress Photo Gallery – Image Gallery by Ape plugin <= 2.0.6 - Authenticated Arbitrary plugin deactivation

Authenticated Arbitrary plugin deactivation found by Jerome Bruandet in WordPress Photo Gallery – Image Gallery by Ape plugin versions = 2.0.6. Solution Update the WordPress Photo Gallery – Image Gallery by Ape plugin to the latest available version at least 2.0.7...

WordPress < 3.3.2 Multiple Vulnerabilities

Binary data 9101.prm...

CVE-2012-2402

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors...

CVE-2012-2402

wp-admin/plugins.php in WordPress before 3.3.2 allows remote authenticated site administrators to bypass intended access restrictions and deactivate network-wide plugins via unspecified vectors...