PT-2013-5868

Name of the Vulnerable Software and Affected Versions NOSpam PTI plugin version 2.1 for WordPress Description The issue allows remote attackers to execute arbitrary SQL commands. This is achieved via the comment post ID parameter in the wp-comments-post.php file. Recommendations For NOSpam PTI...

PT-2013-4579

Name of the Vulnerable Software and Affected Versions Feedweb plugin versions prior to 1.9 Description A cross-site scripting issue exists, allowing remote authenticated administrators to inject arbitrary web script or HTML. This is achieved via the wp post id parameter in the widget remove.php...

Wordpress W3 Total Cache PHP Code Execution Vulnerability

This Metasploit module exploits a PHP Code Injection vulnerability against Wordpress plugin W3 Total Cache for versions up to and including 0.9.2.8. WP Super Cache 1.2 or older is also reported as vulnerable. The vulnerability is due to the handling of certain macros such as mfunc, which allows...

WordPress W3 Total Cache PHP Code Execution

This module exploits a PHP Code Injection vulnerability against WordPress plugin W3 Total Cache for versions up to and including 0.9.2.8. WP Super Cache 1.2 or older is also reported as vulnerable. The vulnerability is due to the handling of certain macros such as mfunc, which allows arbitrary PH...

PT-2012-2106

Name of the Vulnerable Software and Affected Versions Adminimize plugin versions prior to 1.7.22 Description The issue allows remote attackers to inject arbitrary web script or HTML. This can be achieved via the page parameter to API endpoints such as "/inc-options/deinstall options.php",...

PT-2011-5188

Name of the Vulnerable Software and Affected Versions Pulse Pro CMS version 1.7.2 Description The issue concerns multiple cross-site scripting XSS vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. Specifically, the vulnerabilities can be exploit...

Ultimate PHP Board 2.2.7 - Broken Authentication and Session Management

Ultimate PHP Board 2.2.7 - Broken Authentication and Session Management Exploit Title : Ultimate PHP Board 2.2.7 "Broken Authentication and Session Management" Date : 2011.05.17 Author : i2sec - Gi bum Hong Software Link : http://sourceforge.net/projects/textmb/files/UPB/UPB%202.2.7/ Version :...

Lotus CMS Fraise 3.0 - Local File Inclusion / Remote Code Execution

!/usr/bin/python Lotus CMS Fraise v3.0 LFI - Remote Code Execution Exploit greetz Tecr0C :0 Vuln: lines 15-23 in core/lib/router.php ---------- sof //Get page request if any $page = $this-getInputString"page", "index"; //Get plugin request if any $plugin = $this-getInputString"system", "Page"; //...

Max.Blog 1.0.6 Delete Post Exploit

Max.Blog 1.0.6 Delete Post Exploit Max.Blog 1.0.6 Delete Post Exploit Discovered by SirGod Thanks to Nytro Please visit : ------------------------ www.mortal-team.org ------------------------ www.h4cky0u.org ------------------------ www.xpl0it.info ------------------------ www.anti-intruders.org...

Unrestricted file upload

Unrestricted file upload vulnerability in WordPress before 2.2.1 and WordPress MU before 1.2.3 allows remote authenticated users to upload and execute arbitrary PHP code by making a post that specifies a .php filename in the wpattachedfile metadata field; and then sending this file's content, alo...

CVE-2007-1989

Multiple cross-site scripting XSS vulnerabilities in DotClear before 1.2.6 allow remote attackers to inject arbitrary web script or HTML via the 1 postid parameter to ecrire/trackback.php or the 2 toolurl parameter to tools/thememng/index.php. NOTE: some of these details are obtained from third...

Wordpress 2.1.2 (xmlrpc) Remote SQL Injection Exploit

Exploit for unknown platform in category web applications ===================================================== Wordpress 2.1.2 xmlrpc Remote SQL Injection Exploit ===================================================== !/usr/bin/perl -w Wordpress 2.1.2 SQL Injection POC Wordpress version 2.1.2 is...