336 matches found
CVE-2016-10941
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF...
CVE-2016-10942
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has SQL injection via the insertid parameter exploitable via CSRF...
CVE-2016-10941
The vulnerability CVE-2016-10941 affects the Podlove Podcast Publisher (podlove-podcasting-plugin-for-wordpress) for WordPress prior to version 2.3.16. The issue is an XSS vulnerability that is exploitable via CSRF, allowing an attacker to inject and execute client-side code in affected sites. Do...
CVE-2016-10941
The podlove-podcasting-plugin-for-wordpress plugin before 2.3.16 for WordPress has XSS exploitable via CSRF...
WordPress Podlove Podcast Publisher SQL Injection Vulnerability
WordPress Podlove Podcast Publisher is a workflow-oriented solution for podcasters who want to save time and gain complete control over the integrity of their Podcast publishing process, published content, and published content. A SQL injection vulnerability exists in the orderby parameter in...
CVE-2017-12949
lib\modules\contributors\contributorlisttable.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF...
Design/Logic Flaw
lib\modules\contributors\contributorlisttable.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF...
CVE-2017-12949
Podlove Podcast Publisher plugin for WordPress contains a SQL injection in lib/modules/contributors/contributor_list_table.php affecting version 2.5.3 and earlier, via the orderby parameter in wp-admin/admin.php and exploitable through CSRF. The issue is associated with CVE-2017-12949 and has bee...
CVE-2017-12949
lib\modules\contributors\contributorlisttable.php in the Podlove Podcast Publisher plugin 2.5.3 and earlier for WordPress has SQL injection in the orderby parameter to wp-admin/admin.php, exploitable through CSRF...
WordPress Podlove Podcast Publisher 2.5.3 SQL Injection Vulnerability
Exploit for php platform in category web applications Advisory Title: WordPress Podlove Podcast Publisher Plugin Security Vulnerability Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Podlove Podcast Publisher plugin Language: PHP Version: 2.5.3 and below Vendor Status...
Podlove Podcast Publisher <= 2.5.3 - Authenticated SQL Injection
During the security analysis, ThunderScan discovered SQL injection vulnerability in Podlove Podcast Publisher WordPress plugin. The easiest way to reproduce the vulnerability is to visit the provided URL while being logged in as administrator or another user that is authorized to access the plugi...
WordPress Podlove Podcast Publisher 2.5.3 SQL Injection
DefenseCode ThunderScan SAST Advisory WordPress Podlove Podcast Publisher Plugin Security Vulnerability Advisory ID: DC-2017-05-006 Advisory Title: WordPress Podlove Podcast Publisher Plugin Security Vulnerability Advisory URL: http://www.defensecode.com/advisories.php Software: WordPress Podlove...
WordPress Podlove Podcast Publisher plugin <=2.5.3 - SQL injection (SQLi) vulnerability
SQL injection SQLi vulnerability found by Neven Biruski in WordPress Podlove Podcast Publisher plugin version 2.5.3 and earlier version. This vulnerability allows registered users to get access to the database even if they don't have full administrator rights. Moreover, Cross Site request forgery...
WordPress Plugin Podlove Podcast Publisher Cross Site Scripting and SQL Injection Vulnerabilities
The second plugin that will be dissected is called Podlove Publisher, a Wordpress plugin to manage podcasts. It suffered from multiple SQL injections and cross-site scripting vulnerabilities funnily enough also in a parameter named tab that are fixed by now. The SQL injections were all caused by...