Privilege Escalation

WordPress is vulnerable to privilege escalation attacks. The attacks are possible through changing the userID parameter in wp-admin/includes/post.php, allowing any authenticated users to create a post as if written by another user...

Upworthy Clone Script 1.1.0 - id SQL Injection

Upworthy Clone Script 1.1.0 - id SQL Injection Exploit Title: Flippy BuzzWorthy – Upworthy Clone Script v1.1.0 - SQL Injection Google Dork: N/A Date: 06.02.2017 Vendor Homepage: https://www.flippyscripts.com/ Software Buy: https://www.flippyscripts.com/flippy-buzzworthy-upworthy-clone-script/ Dem...

Funny Image and Video Script 2.0.0 - 'id' SQL Injection

Exploit Title: Flippy ChillOut – Funny Image and Video Script v2.0.0 - SQL Injection Google Dork: N/A Date: 06.02.2017 Vendor Homepage: https://www.flippyscripts.com/ Software Buy: https://www.flippyscripts.com/flippy-chillout-funny-image-and-video-script/ Demo: http://chillout.flippydemos.com/...

Upworthy Clone Script 1.1.0 - 'id' SQL Injection

Exploit Title: Flippy BuzzWorthy – Upworthy Clone Script v1.1.0 - SQL Injection Google Dork: N/A Date: 06.02.2017 Vendor Homepage: https://www.flippyscripts.com/ Software Buy: https://www.flippyscripts.com/flippy-buzzworthy-upworthy-clone-script/ Demo: http://buzzworthy.flippydemos.com/ Version:...

VbmCMS system post.php file the catid parameter SQL injection vulnerability

No description provided by source...

VBcms /post.php SQL注入

No description provided by source...

CVE-2015-3273

mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization...

PT-2016-1289

Name of the Vulnerable Software and Affected Versions Moodle versions 2.9.x through 2.9.0 Description The issue is related to insufficient access control in the mod/forum/post.php function of the Moodle learning management system. This can be exploited by a remote attacker to bypass existing acce...

CVE-2015-3273: Undefined Security Weakness

mod/forum/post.php in Moodle 2.9.x before 2.9.1 does not consider the mod/forum:canposttomygroups capability before authorizing "Post a copy to all groups" actions, which allows remote authenticated users to bypass intended access restrictions by leveraging per-group authorization...

CVE-2015-2213

SQL injection vulnerability in the wpuntrashpostcomments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash...

CVE-2015-5731

Cross-site request forgery CSRF vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service editing blockage, via a get-post-lock action...

CVE-2015-2213: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the wpuntrashpostcomments function in wp-includes/post.php in WordPress before 4.2.4 allows remote attackers to execute arbitrary SQL commands via a comment that is mishandled after retrieval from the trash...

CVE-2015-5731: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in wp-admin/post.php in WordPress before 4.2.4 allows remote attackers to hijack the authentication of administrators for requests that lock a post, and consequently cause a denial of service editing blockage, via a get-post-lock action...

WordPress 4.2.3 and earlier SQL Injection Vulnerability

Exploit for php platform in category web applications A potential SQL injection that could be used to compromise a site FIX: trunk/src/wp-includes/post.php foreach $groupbystatus as $status = $comments // Sanity check. This shouldn't happen. - if 'post-trashed' == $status + if 'post-trashed' ==...

DEBIAN-CVE-2015-5623

WordPress before 4.2.3 does not properly verify the editposts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php...

CVE-2015-5623

WordPress before 4.2.3 does not properly verify the editposts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php...

CVE-2015-5623: Improper Access Control

WordPress before 4.2.3 does not properly verify the editposts capability, which allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role, as demonstrated by a post-quickdraft-save action to wp-admin/post.php...

PT-2015-6990

Name of the Vulnerable Software and Affected Versions WordPress versions prior to 4.2.3 Description The issue allows remote authenticated users to bypass intended access restrictions and create drafts by leveraging the Subscriber role. This can be achieved by sending a post-quickdraft-save action...

CVE-2015-4064

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php...

Sql injection

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php...