435 matches found
CVE-2019-14773: Undefined Security Weakness
admin/includes/class.actions.snippet.php in the "Woody ad snippets" plugin through 2.2.5 for WordPress allows wp-admin/admin-post.php?action=close&post= deletion...
CVE-2019-9978: Improper Neutralization of Input During Web Page Generation
The social-warfare plugin before 3.5.3 for WordPress has stored XSS via the wp-admin/admin-post.php?swpdebug=loadoptions swpurl parameter, as exploited in the wild in March 2019. This affects Social Warfare and Social Warfare Pro...
PT-2019-19742
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for the deletion of articles via a CSRF vulnerability in the "mc-admin/post.php" endpoint, specifically when the "state" parameter is set to "publish" and the "delete" parameter is utilized...
CVE-2019-9603: Cross-Site Request Forgery (CSRF)
MiniCMS 1.10 allows mc-admin/post.php?state=publish&delete= CSRF to delete articles, a different vulnerability than CVE-2018-18891...
WordPress_4.9.8_RCE_POC
Summary A simple PoC for WordPress RCE author priviledge, re...
CMSsite 1.0 - post SQL Injection
CMSsite 1.0 - post SQL Injection Exploit Title: CMSsite 1.0 - 'post' SQL Injection Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: February 17, 2019 Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link :...
CMSsite 1.0 post.php SQL Injection
Exploit Title: CMSsite 1.0 - 'post' SQL Injection Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: February 17, 2019 Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link : https://github.com/VictorAlagwu/CMSsite/archive/master.zip Tested Versio...
CMSsite 1.0 - post SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: CMSsite 1.0 - 'post' SQL Injection Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: February 17, 2019 Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link :...
CMSsite 1.0 - 'post' SQL Injection
Exploit Title: CMSsite 1.0 - 'post' SQL Injection Exploit Author: Mr Winst0n Author E-mail: [email protected] Discovery Date: February 17, 2019 Vendor Homepage: https://github.com/VictorAlagwu/CMSsite Software Link : https://github.com/VictorAlagwu/CMSsite/archive/master.zip Tested Versio...
Object Injection
wordpress is vulnerable to PHP object injection. The vulnerability exists in the wpgetattachmentthumbfile function in wp-includes/post.php because the attack can be triggered by inputting manipulated metadata. in the wpgetattachmentthumbfile function in wp-includes/post.php...
CVE-2018-20148
In WordPress before 4.9.9 and 5.x before 5.0.1, contributors could conduct PHP object injection attacks via crafted metadata in a wp.getMediaItem XMLRPC call. This is caused by mishandling of serialized data at phar:// URLs in the wpgetattachmentthumbfile function in wp-includes/post.php...
PT-2018-15269
Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.9.9 WordPress versions 5.x prior to 5.0.1 Description The issue arises from the mishandling of serialized data at phar:// URLs in the wp get attachment thumb file function, located in wp-includes/post.php. This...
KeyBase Botnet 1.5 - SQL Injection
KeyBase Botnet 1.5 - SQL Injection Exploit Title: KeyBase Botnet v1.5 - SQL Injection Vulnerability Google Dork: intitle:"KeyBase: Login" + intext:" Login to get access to your logs " Date: 3/12/2018 Exploit Author: n4pst3r Vendor Homepage: unkn0wn Software Link: unkn0wn Version: v1.5 Tested on:...
CVE-2018-19564
Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters ikcfclient and ikcfposition and ikcfother have Cross-Site Scripting...
CVE-2018-19564: Improper Neutralization of Input During Web Page Generation
Stored XSS was discovered in the Easy Testimonials plugin 3.2 for WordPress. Three wp-admin/post.php parameters ikcfclient and ikcfposition and ikcfother have Cross-Site Scripting...
PT-2018-15008
Name of the Vulnerable Software and Affected Versions Easy Testimonials plugin version 3.2 for WordPress Description A Stored XSS issue was found, allowing for Cross-Site Scripting through the ikcf client, ikcf position, and ikcf other parameters in the wp-admin/post.php endpoint. Recommendations...
CVE-2018-18891
MiniCMS 1.10 is affected by CVE-2018-18891. The vulnerability arises because authentication is checked too late in the request flow, enabling file deletion via /mc-admin/post.php?state=delete&delete=. The Red Hat page reiterates the same issue. The provided documents do not specify vulnerable ver...
PT-2018-14711
Name of the Vulnerable Software and Affected Versions MiniCMS version 1.10 Description The issue allows for full path disclosure through the "/mc-admin/post.php" endpoint with specific parameters, such as state set to "delete" and delete set to an invalid filename. Recommendations For MiniCMS...
CVE-2018-18890: Improper Limitation of a Pathname to a Restricted Directory
MiniCMS 1.10 allows full path disclosure via /mc-admin/post.php?state=delete&delete= with an invalid filename...