CVE-2015-4064

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php...

CVE-2015-4064

SQL injection vulnerability in modules/module.ab-testing.php in the Landing Pages plugin before 1.8.5 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the post parameter in an edit delete-variation action to wp-admin/post.php...

PT-2015-6405

Name of the Vulnerable Software and Affected Versions Landing Pages plugin versions prior to 1.8.5 Description The issue allows remote authenticated users to execute arbitrary SQL commands. This is achieved via the post parameter in an edit delete-variation action to "wp-admin/post.php"...

WordPress Car Demon Plugin <= 1.0.1 - Cross Site Scripting

This plugin is prone to a cross site scripting vulnerability in /wp-admin/post.php and /wp-admin/edit.php multiple parameters. Solution Update the plugin...

PT-2015-5666

Name of the Vulnerable Software and Affected Versions NetCat versions 5.01 and earlier Description The issue allows remote attackers to obtain the installation path. This is achieved via the redirect url parameter to "netshop/post.php" API endpoint. Recommendations For NetCat versions 5.01 and...

PT-2015-5672

Name of the Vulnerable Software and Affected Versions Ninja Forms plugin versions prior to 2.8.9 Description The issue allows remote attackers to inject arbitrary web script or HTML, and it also affects remote administrators. This can be achieved through the "ninja forms field 1" parameter in a...

CVE-2015-2214: Exposure of Sensitive Information to an Unauthorized Actor

NetCat 5.01 and earlier allows remote attackers to obtain the installation path via the redirecturl parameter to netshop/post.php...

CVE-2015-1494

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting XSS attacks via an mfbfw parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfwpadding parameter and...

PT-2015-5329

Name of the Vulnerable Software and Affected Versions FancyBox for WordPress versions prior to 3.0.3 Description The issue allows remote attackers to conduct cross-site scripting XSS attacks via a mfbfw parameter in an update action to "wp-admin/admin-post.php". This has been exploited in the wil...

CVE-2015-1494: Improper Neutralization of Input During Web Page Generation

The FancyBox for WordPress plugin before 3.0.3 for WordPress does not properly restrict access, which allows remote attackers to conduct cross-site scripting XSS attacks via an mfbfw parameter in an update action to wp-admin/admin-post.php, as demonstrated by the mfbfwpadding parameter and...

Sql injection

Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote plugin before 0.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 cdnvotepostid or 2 cdnvotepoint parameter...

PT-2015-3504

Name of the Vulnerable Software and Affected Versions cdnvote plugin versions prior to 0.4.2 Description The issue concerns SQL injection vulnerabilities in the cdnvote-post.php file of the cdnvote plugin for WordPress. Remote attackers can execute arbitrary SQL commands by manipulating the cdnvo...

CVE-2011-5308: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in cdnvote-post.php in the cdnvote plugin before 0.4.2 for WordPress allow remote attackers to execute arbitrary SQL commands via the 1 cdnvotepostid or 2 cdnvotepoint parameter...

Qibo Menhu /2shou/post.php SQL注入漏洞

No description provided by source...

qibocms地方门户系统注入（多处类似,demo测试)

简要描述： 初始化啊 初始化。 详细说明： 很多类似的 随便找个地方把。 首先注册个会员。 在dianping/post.php中 if$action=="postnew" if$webdbForbidPostMore if$db-getone"SELECT FROM $precontent WHERE uid='$lfjuid' LIMIT 1" showerr"系统设置每人只能发布一个商铺!"; if!checkrandnum$POST"$webdbrandnuminputname" showerr"系统随机码失效,请返回,刷新一下页面,再重新输入数据,重新提交!";...

QiboCMS v7 /member/post.php SQL注入漏洞

No description provided by source...

NOSpamPTI 2.1 - wp-comments-post.php comment_post_ID Parameter SQL Injection

The nospampti WordPress plugin was affected by a wp-comments-post.php commentpostID Parameter SQL Injection security vulnerability...

Authentication flaw

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

CVE-2014-4725

The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...

PT-2014-6077

Name of the Vulnerable Software and Affected Versions MailPoet Newsletters wysija-newsletters plugin versions prior to 2.6.7 Description The issue allows remote attackers to bypass authentication and execute arbitrary PHP code. This is achieved by uploading a crafted theme using the...