1698 matches found
WordPress Plugin Kento Post View Counter 2.8 - Cross-Site Request Forgery Cross-Site Scripting
WordPress Plugin Kento Post View Counter 2.8 - Cross-Site Request Forgery Cross-Site Scripting I would like to disclose CSRF and stored XSS vulnerability in Kento post view counter plugin version 2.8 . The vulnerable Fields for XSS are kentopvcnumberslang kentopvctodaytext kentopvctotaltext The...
WordPress Plugin leenk.me 2.5.0 - Cross-Site Request Forgery Cross-Site Scripting
WordPress Plugin leenk.me 2.5.0 - Cross-Site Request Forgery Cross-Site Scripting I would like to disclose CSRF and stored XSS vulnerability in Wordpress plugin LeenkMe version 2.5.0. The plugin can be found at https://wordpress.org/plugins/leenkme/ In the page...
WordPress Ebook Download Plugin Directory Traversal Vulnerability
The WordPress plugin SPDX-FileCopyrightText: 2016 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE = "cpe:/a:wordpress:wordpress"; ifdescription...
WordPress CP Reservation Calendar Plugin SQL Injection Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation, and CP Reservation Calendar is one of the event calendar plugins. A SQL injection vulnerability exists in the dexreservations.php script in version 1.1.7 of the WordPress CP Reservation...
EZ SQL Reports < 4.11.37 - Multiple Vulnerabilities
Exploit for php platform in category web applications Exploit Title: EZ SQL Reports Proxy-Connection: keep-alive Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,/;q=0.8 Upgrade-Insecure-Requests: 1 User-Agent: Referer: http:///wp-admin/admin.php?page=ELISQLREPORTS-setting...
WordPress YouTube Embed Plugin Cross-Site Scripting Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation. A cross-site scripting vulnerability exists in the includes/options-profiles.php script in WordPress YouTube Embed plugin versions prior to 3.3.3. The vulnerability can be exploited by ...
WordPress WP-Mon Arbitrary File Download Vulnerability
WordPress WP-Mon plugin suffers from an arbitrary file disclosure vulnerability. |||||||||||||||||||||||||||||||||||||||||||||||||| |-------------------------------------------------------------------------| | + Exploit Title:Wordpress wp-mon Plugin Arbitrary File Download Vulnerability | | +...
WordPress Plugin Pie Register Has Unspecified Vulnerability
WordPress is the WordPress Software Foundation of a set of PHP language development of the blogging platform, the platform supports PHP and MySQL server set up a personal blog site . Pie Register is one of the plug-ins that support customizing the member registration landing page . A security...
WordPress Like Dislike Counter 1.2.3 SQL Injection
Title : Wordpress Like Dislike Counter Plugin SQL Injection Vulnerability Risk : High+/Critical Exploit Author : XroGuE Google Dork : inurl:plugins/like-dislike-counter-for-posts-pages-and-comments/ajaxcounter.php AND plugins/pro-like-dislike-counter/ldc-ajax-counter.php Plugin Version : 1.2.3...
WordPress VideoWhisper Video Presentation plugin <= 1.1 - SQL Injection Vulnerability
No description provided by source. Exploit Title: WordPress VideoWhisper Video Presentation plugin = 1.1 SQL Injection Vulnerability Date: 2011-09-02 Author: Miroslav Stampar miroslav.stamparatgmail.com @stamparm Software Link:...
Ian Dunn: Multiple Path Disclosure
Hi Ian, I have downloaded all the latest version's of plugin's from your wp profile and did a quick check for FPD. I know you may point out that WP does'nt consider it as a issue however i personally for plugin i look at it as a miss on best practice from plugin developers part. I do not expect a...
Wordpress Better WP Security Plugin - Stored XSS Vulnerability
Richard Warren ======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren Vendor: Bit51 Vendor Reference: Systems Affected: Bit51 Better WP Security Plugin Version...
VulnCheck KEV: CVE-2012-10064
Omni Secure Files plugin versions prior to 0.1.14 contain an arbitrary file upload vulnerability in the bundled plupload example endpoint. The /wp-content/plugins/omni-secure-files/plupload/examples/upload.php handler allows unauthenticated uploads without enforcing safe file type restrictions,...
Worldweaver DX Studio Player 3.0.29 - 'shell.execute()' Command Execution (Metasploit)
$Id: dxstudioplayerexec.rb 9375 2010-05-26 22:39:56Z jduck $ This file is part of the Metasploit Framework and may be subject to redistribution and commercial restrictions. Please see the Metasploit Framework web site for more information on licensing and terms of use...
Worldweaver DX Studio Player shell.execute() Command Execution
This module exploits a command execution vulnerability within the DX Studio Player from Worldweaver for versions 3.0.29 and earlier. The player is a browser plugin for IE ActiveX and Firefox dll. When an unsuspecting user visits a web page referring to a specially crafted .dxstudio document, an...
AwingSoft Winds3D Player 3.5 SceneURL Download and Execute
This module exploits an untrusted program execution vulnerability within the Winds3D Player from AwingSoft. The Winds3D Player is a browser plugin for IE ActiveX, Opera DLL and Firefox XPI. By setting the 'SceneURL' parameter to the URL to an executable, an attacker can execute arbitrary code...
Nessus Scan Information
This plugin displays, for each tested host, information about the scan itself : - The version of the plugin set. - The type of scanner Nessus or Nessus Home. - The version of the Nessus Engine. - The port scanners used. - The port range scanned. - The ping round trip time - Whether credentialed o...
SSL Certificate Expiry
This plugin checks expiry dates of certificates associated with SSL- enabled services on the target and reports whether any have already expired. TRUSTED...