PT-2018-10717

Name of the Vulnerable Software and Affected Versions MULTIDOTS Woo Checkout for Digital Goods plugin version 2.1 Description An issue allows attackers to change plugin settings by tricking an admin user into visiting a crafted URL. The woo checkout settings page function in the file...

CVE-2018-11632: Cross-Site Request Forgery (CSRF)

An issue was discovered in the MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin 1.0.8 for WordPress. If an admin user can be tricked into visiting a crafted URL created by an attacker via spear phishing/social engineering, the attacker can change the plugin settings via...

PT-2018-10716

Name of the Vulnerable Software and Affected Versions MULTIDOTS Add Social Share Messenger Buttons Whatsapp and Viber plugin version 1.0.8 Description An issue in the plugin allows an attacker to change its settings via a crafted URL, exploiting a CSRF vulnerability in the wp-admin/admin-post.php...

CVE-2018-10423

mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article...

CVE-2018-10423: Exposure of Sensitive Information to an Unauthorized Actor

mc-admin/post.php in MiniCMS 1.10 allows remote attackers to obtain a directory listing of the top-level directory of the web root via a link that becomes available after posting an article...

PT-2018-9876

Name of the Vulnerable Software and Affected Versions: MiniCMS version 1.10 Description: The issue allows remote attackers to obtain a directory listing of the top-level directory of the web root. This can be achieved by creating a link that becomes available after posting an article, specificall...

MiniCMS Information Disclosure Vulnerability (CNVD-2018-08993)

MiniCMS is a mini content management system CMS designed for personal websites. An information disclosure vulnerability exists in the mc-admin/post.php file in MiniCMS version 1.10. A remote attacker can exploit this vulnerability to view all files located in the web root path...

watpho.com XSS vulnerability

Open Bug Bounty ID: OBB-606200 Description| Value ---|--- Affected Website:| watpho.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

CVE-2018-5312: Improper Neutralization of Input During Web Page Generation

The tabs-responsive plugin 1.8.0 for WordPress has XSS via the posttitle parameter to wp-admin/post.php...

PT-2018-16889

Name of the Vulnerable Software and Affected Versions tabs-responsive plugin version 1.8.0 Description The issue concerns a security problem where an attacker can exploit the post title parameter in the wp-admin/post.php endpoint to execute malicious scripts. Recommendations For tabs-responsive...

CVE-2018-5212

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdmuploadthumbnail aka File Thumbnail parameter in an edit action to wp-admin/post.php...

CVE-2018-5213

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdmupload aka Downloadable File parameter in an edit action to wp-admin/post.php...

CVE-2018-5212: Improper Neutralization of Input During Web Page Generation

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdmuploadthumbnail aka File Thumbnail parameter in an edit action to wp-admin/post.php...

CVE-2018-5213: Improper Neutralization of Input During Web Page Generation

The Simple Download Monitor plugin before 3.5.4 for WordPress has XSS via the sdmupload aka Downloadable File parameter in an edit action to wp-admin/post.php...

PT-2018-16804

Name of the Vulnerable Software and Affected Versions Simple Download Monitor plugin versions prior to 3.5.4 Description The issue allows for XSS via the sdm upload thumbnail parameter in an edit action to the "/wp-admin/post.php" endpoint. This affects the plugin's functionality related to file...

PT-2018-16805

Name of the Vulnerable Software and Affected Versions Simple Download Monitor plugin versions prior to 3.5.4 Description The issue allows for XSS via the sdm upload parameter in an edit action to the "wp-admin/post.php" endpoint. This affects the WordPress plugin, potentially allowing malicious...

chiangmaifishing.com XSS vulnerability

Open Bug Bounty ID: OBB-428595 Description| Value ---|--- Affected Website:| chiangmaifishing.com Open Bug Bounty Program:| Create your bounty program now. It's open and free. Vulnerable Application:| Custom Code Vulnerability Type:| XSS Cross Site Scripting / CWE-79 CVSSv3 Score:| 6.1...

WordPress: Arbitrary file deletion in wp-core - guides towards RCE and information disclosure

Vulnerable place 1: wp-admin/post.php $newmeta'thumb' is placed into DB not sanitized directly from user input. case 'editattachment': checkadminreferer'update-post' . $postid; // Don't let these be changed unset$POST'guid'; $POST'posttype' = 'attachment'; // Update the thumbnail filename $newmet...

CVE-2017-16230

In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-edit...

CVE-2017-16230: Improper Neutralization of Input During Web Page Generation

In admin/write-post.php in Typecho through 1.1, one can log in to the background page, write a new article, and add payload in the article content, resulting in XSS via index.php/action/contents-post-edit...