PT-2022-16543

Name of the Vulnerable Software and Affected Versions eliteCMS version 1.0 Description The issue is related to a SQL injection vulnerability. This vulnerability can be exploited via the "/admin/edit post.php" API endpoint. Recommendations For eliteCMS version 1.0, as a temporary workaround,...

PT-2022-7046

Name of the Vulnerable Software and Affected Versions Popup Builder WordPress plugin versions prior to 4.0.7 Description The issue is related to the lack of protection against SQL query structure exploitation when handling orderby and order parameters in the admin-post.php script of the Popup...

PT-2021-10555

Name of the Vulnerable Software and Affected Versions: Qibosoft version 7 Description: A Cross-Site Request Forgery CSRF issue exists in the /member/post.php?job=postnew&step=post endpoint of the affected software, allowing attackers to force victim users into publishing new articles via a crafte...

CVE-2020-20943: Cross-Site Request Forgery (CSRF)

A Cross-Site Request Forgery CSRF in /member/post.php?job=postnew&step=post of Qibosoft v7 allows attackers to force victim users into arbitrarily publishing new articles via a crafted URL...

PT-2021-16455

Name of the Vulnerable Software and Affected Versions: Victor CMS version 1.0 Description: The issue allows attackers to execute arbitrary code via the file upload to the /admin/includes/admin add post.php endpoint. This is due to an arbitrary file upload vulnerability. Recommendations: For Victo...

CVE-2020-35749

Directory traversal vulnerability in class-simplejobboardresumedownloadhandler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjbfile parameter to wp-admin/post.php...

CVE-2020-35749: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in class-simplejobboardresumedownloadhandler.php in the Simple Board Job plugin 2.9.3 and earlier for WordPress allows remote attackers to read arbitrary files via the sjbfile parameter to wp-admin/post.php...

PT-2021-11843

Name of the Vulnerable Software and Affected Versions: Simple Board Job plugin versions 2.9.3 and earlier Description: A directory traversal issue allows remote attackers to read arbitrary files via the sjb file parameter to "wp-admin/post.php". Recommendations: For Simple Board Job plugin versio...

CVE-2020-35582: Improper Neutralization of Input During Web Page Generation

A stored cross-site scripting XSS issue in Envira Gallery Lite before 1.8.3.3 allows remote attackers to inject arbitrary JavaScript/HTML code via a POST /wp-admin/post.php request with the posttitle parameter...

PT-2021-11809

Name of the Vulnerable Software and Affected Versions: Envira Gallery Lite versions prior to 1.8.3.3 Description: A stored cross-site scripting XSS issue allows remote attackers to inject arbitrary JavaScript/HTML code via a POST "/wp-admin/post.php" request with the post title parameter...

PT-2020-16483

Name of the Vulnerable Software and Affected Versions Testimonial Rotator Wordpress Plugin version 3.0.2 Description The issue concerns a Cross Site Scripting XSS problem. Specifically, it involves the /wp-admin/post.php endpoint. If a user intercepts a request and inserts a payload in the cite...

CVE-2020-26672: Improper Neutralization of Input During Web Page Generation

Testimonial Rotator Wordpress Plugin 3.0.2 is affected by Cross Site Scripting XSS in /wp-admin/post.php. If a user intercepts a request and inserts a payload in "cite" parameter, the payload will be stored in the database...

CVE-2020-14959: Improper Neutralization of Input During Web Page Generation

Multiple XSS vulnerabilities in the Easy Testimonials plugin before 3.6 for WordPress allow remote attackers to inject arbitrary web script or HTML via the wp-admin/post.php Client Name, Position, Web Address, Other, Location Reviewed, Product Reviewed, Item Reviewed, or Rating parameter...

Victor CMS 1.0 - (post) SQL Injection Vulnerability

Exploit for php platform in category web applications Exploit Title: Victor CMS 1.0 - 'post' SQL Injection Exploit Author: BKpatron Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: v1.0 Tested on: Win 10 CV...

Victor CMS 1.0 SQL Injection

Exploit Title: Victor CMS 1.0 - 'post' SQL Injection Google Dork: N/A Date: 2020-05-09 Exploit Author: BKpatron Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: v1.0 Tested on: Win 10 CVE: N/A my website:...

Victor CMS 1.0 - 'post' SQL Injection

Exploit Title: Victor CMS 1.0 - 'post' SQL Injection Google Dork: N/A Date: 2020-05-09 Exploit Author: BKpatron Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link: https://github.com/VictorAlagwu/CMSsite/archive/master.zip Version: v1.0 Tested on: Win 10 CVE: N/A my website:...

CVE-2020-10195

The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal...

CVE-2020-10195: Exposure of Sensitive Information to an Unauthorized Actor

The popup-builder plugin before 3.64.1 for WordPress allows information disclosure and settings modification, leading to in-scope privilege escalation via admin-post actions to com/classes/Actions.php. By sending a POST request to wp-admin/admin-post.php, an authenticated attacker with minimal...

60CycleCMS - news.php SQL Injection

60CycleCMS - news.php SQL Injection Exploit Title: 60CycleCMS - 'news.php' Multiple vulnerability Google Dork: N/A Date: 2020-02-10 Exploit Author: Unkn0wn Vendor Homepage: http://davidvg.com/ Software Link: https://www.opensourcecms.com/60cyclecms Version: 2.5.2 Tested on: Ubuntu CVE : N/A...

PT-2020-6781

Name of the Vulnerable Software and Affected Versions Easy Testimonials plugin versions prior to 3.6 for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML via certain parameters in the wp-admin/post.php file, including Client Name, Position, Web Addres...