1253 matches found
CVE-2015-4064
SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php...
CVE-2015-4065
Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php...
CVE-2015-4065
Summary (CVE-2015-4065) : The WordPress Landing Pages plugin (versions before 1.8.5) contains an XSS vulnerability in shared/shortcodes/inbound-shortcodes.php. An authenticated remote user can inject arbitrary script/HTML via the post parameter passed to wp-admin/post-new.php, caused by echoing u...
CVE-2015-4064: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php...
CVE-2015-4065: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php...
PT-2015-6406
Name of the Vulnerable Software and Affected Versions Landing Pages plugin versions prior to 1.8.5 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote authenticated users to inject arbitrary web script or HTML. The injection can be done v...
PT-2015-6405
Name of the Vulnerable Software and Affected Versions Landing Pages plugin versions prior to 1.8.5 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the post parameter in an edit delete-variation action to "wp-admin/post.php"...
WordPress Landing Pages Plugin <= 1.8.4 - XSS
Cross-site scripting XSS vulnerability in shared/shortcodes/inbound-shortcodes.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the post parameter to wp-admin/post-new.php. Solution Upgrade the plugin...
WordPress Booking Calendar Contact Form 1.0.2 - Multiple Vulnerabilities
Exploit for php platform in category web applications Exploit Title: WordPress Booking Calendar Contact Form 1.0.2Multiple vulnerabilities Date: 2015-05-01 Google Dork: Index of /wordpress/wp-content/plugins/booking-calendar-contact-form/ Exploit Author: Joaquin Ramirez Martinez i0akiN...
Ultimate Product Catalogue <= 3.1.2 - Unauthenticated SQL Injection
Unauthenticated SQL injection in ajax call when the plugin is counting the times a product is being seen by the web visitors. The vulnerable POST parameter is "ItemID". Vulnerable code: In file Functions/ProcessAjax.php line 67: ... $ItemID = $POST'ItemID'; $Item = $wpdb-getrow"SELECT ItemViews...
WordPress Plugin MiwoFTP CSRF Arbitrary File Deletion Vulnerability
WordPress is a blogging platform developed using the PHP language, users can set up their own weblogs on servers that support PHP and MySQL databases.MiwoFTP is a smart, fast, lightweight file manager plugin. WordPress plugin MiwoFTP CSRF has a security vulnerability. Due to the input passed to t...
OrangeHRM /index.php/recruitment/viewCandidates sortField SQL Injection Vulnerability
OrangeHRM is an open source human resource management tools , features include employee data management , employee self-service system , attendance , allowances and recruitment and other functions . OrangeHRM /index.php/recruitment/viewCandidates fails to properly filter the 'sortField' POST...
Multiple Vulnerabilities in TheCartPress WordPress plugin
High-Tech Bridge Security Research Lab discovered multiple vulnerabilities in TheCartPress WordPress plugin, which can be exploited to execute arbitrary PHP code, disclose sensitive data, and perform Cross-Site Scripting attacks against users of WordPress installations with the vulnerable plugin....
Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities
Balero CMS 0.7.2 - Multiple JSHTML Injection Vulnerabilities document.cookie="counter=1confirm'XSS'; path=/balerocms/"; csrf+stored xss+filter bypass+session hijack: document.location="http://www.zeroscience.mk/pent...
Plugin Info Card <= 2.3.6 - Authenticated XSS
Authenticated XSS via wppic-list POST parameter in the wppicwidgetrender AJAX method which is also lacking CSRF and authorisation checks, even in the fixed version...
CVE-2014-9561
Cross-site scripting XSS vulnerability in redirlastpostlist.php in SoftBB 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the post parameter...
CVE-2014-9560: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in redirlastpostlist.php in SoftBB 0.1.3 allows remote attackers to execute arbitrary SQL commands via the post parameter...
CVE-2014-9561: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in redirlastpostlist.php in SoftBB 0.1.3 allows remote attackers to inject arbitrary web script or HTML via the post parameter...
PT-2015-4274
Name of the Vulnerable Software and Affected Versions SoftBB version 0.1.3 Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the post parameter in the redir last post list.php file...
PT-2015-4273
Name of the Vulnerable Software and Affected Versions SoftBB version 0.1.3 Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the post parameter in the redir last post list.php file. Recommendations For SoftBB version 0.1.3, consider restricting...