CVE-2020-10195

The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal...

CVE-2020-10195: Exposure of Sensitive Information to an Unauthorized Actor

The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal...

60CycleCMS - news.php SQL Injection

60CycleCMS - news.php SQL Injection Exploit Title: 60CycleCMS - 'news.php' Multiple vulnerability Google Dork: N/A Date: 2020-02-10 Exploit Author: Unkn0wn Vendor Homepage: http://davidvg.com/ Software Link: https://www.opensourcecms.com/60cyclecms Version: 2.5.2 Tested on: Ubuntu CVE : N/A...

PT-2020-6781

Name of the Vulnerable Software and Affected Versions Easy Testimonials plugin versions prior to 3.6 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML via certain parameters in the wp-admin/post.php file, including Client Name, Position, Web Addres...

PT-2020-19356

Name of the Vulnerable Software and Affected Versions WP Database Reset versions 3.1 and earlier Description The issue allows any unauthenticated user to reset any table in the database to the initial WordPress set-up state, resulting in the deletion of all site content stored in that table. This...

CVE-2019-19982: Improper Authentication

The WordPress plugin, Email Subscribers & Newsletters, before 4.2.3 had a flaw that allowed for unauthenticated option creation. In order to exploit this vulnerability, an attacker would need to send a /wp-admin/admin-post.php?esskip=1&optionname= request...

PT-2019-16032

Name of the Vulnerable Software and Affected Versions Email Subscribers & Newsletters versions prior to 4.2.3 Description The issue allows for unauthenticated option creation. To exploit this, an attacker would need to send a request to the "wp-admin/admin-post.php?es skip=1&option name=" endpoin...

Exploit for Missing Authentication for Critical Function in Getigniteup Igniteup

Wordpress IgniteUp plugin vulnerability Wordpress IgniteUp plu...

CVE-2019-17429

Adhouma CMS through 2019-10-09 has SQL Injection via the post.php pid parameter...

Sql injection

Adhouma CMS through 2019-10-09 has SQL Injection via the post.php pid parameter...

CVE-2019-17429

Adhouma CMS through 2019-10-09 has SQL Injection via the post.php pid parameter...

CVE-2019-17429

CVE-2019-17429 affects Adhouma CMS prior to or on 2019-10-09. The vulnerability is an SQL injection in the post.php p_id parameter, as described in the CVE entry and corroborated by Red Hat and NVD records. This flaw enables manipulation of database queries via the affected parameter, with potent...

CVE-2019-17429: Improper Neutralization of Special Elements used in an SQL Command

Adhouma CMS through 2019-10-09 has SQL Injection via the post.php pid parameter...

PT-2019-15150

Name of the Vulnerable Software and Affected Versions Adhouma CMS versions prior to 2019-10-09 Description The issue allows for SQL Injection via the p id parameter in the "post.php" endpoint. Recommendations For Adhouma CMS versions prior to 2019-10-09, avoid using the p id parameter in the...

Cross site request forgery (csrf)

The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF...

CVE-2016-10945: Cross-Site Request Forgery (CSRF)

The PageLines theme 1.1.4 for WordPress has wp-admin/admin-post.php?page=pagelines CSRF...

CVE-2019-14800

The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI...

CVE-2019-14800: Exposure of Sensitive Information to an Unauthorized Actor

The FV Flowplayer Video Player plugin before 7.3.15.727 for WordPress allows guests to obtain the email subscription list in CSV format via the wp-admin/admin-post.php?page=fvplayer&fv-email-export=1 URI...

PT-2019-13845

Name of the Vulnerable Software and Affected Versions FV Flowplayer Video Player plugin versions prior to 7.3.15.727 Description The issue allows unauthorized access to the email subscription list in CSV format. This can be achieved by accessing a specific URI,...

CVE-2019-14791: Improper Neutralization of Input During Web Page Generation

The Appointment Booking Calendar plugin 1.3.18 for WordPress allows XSS via the wp-admin/admin-post.php editionarea parameter...