WordPress <= 3.3.2 - Multiple Vulnerabilities

Because of these vulnerabilities, the attackers can obtain sensitive information or bypass intended media-attachment restrictions via a "postid" value. Solution Update the plugin...

CVE-2011-5128

Multiple cross-site scripting XSS vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to 1 inc-options/deinstalloptions.php, 2 inc-options/themeoptions.php, or 3 inc-options/imexportoptions.php, ...

CVE-2011-5128: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in the Adminimize plugin before 1.7.22 for WordPress allow remote attackers to inject arbitrary web script or HTML via the page parameter to 1 inc-options/deinstalloptions.php, 2 inc-options/themeoptions.php, or 3 inc-options/imexportoptions.php, ...

CVE-2011-5041: Improper Neutralization of Input During Web Page Generation

Multiple cross-site scripting XSS vulnerabilities in Pulse Pro CMS 1.7.2 allow remote attackers to inject arbitrary web script or HTML via the 1 d parameter in a blocks action and 2 postid parameter in an edit-post action to index.php...

CVE-2010-2463

Cross-site scripting XSS vulnerability in forum.php in Jamroom before 4.1.9 allows remote attackers to inject arbitrary web script or HTML via the postid parameter in a modify action...

CVE-2010-2463: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in forum.php in Jamroom before 4.1.9 allows remote attackers to inject arbitrary web script or HTML via the postid parameter in a modify action...

Cross site scripting

Cross-site scripting XSS vulnerability in jobs/index.php in Jamit Job Board 3.0 allows remote attackers to inject arbitrary web script or HTML via the postid parameter...

CVE-2010-0321

Cross-site scripting XSS vulnerability in jobs/index.php in Jamit Job Board 3.0 allows remote attackers to inject arbitrary web script or HTML via the postid parameter...

CVE-2010-0321: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in jobs/index.php in Jamit Job Board 3.0 allows remote attackers to inject arbitrary web script or HTML via the postid parameter...

Design/Logic Flaw

del.php in miniBloggie 1.0 allows remote attackers to delete arbitrary posts via a direct request with a modified postid parameter, a different vulnerability than CVE-2008-4628...

CVE-2008-6650: Undefined Security Weakness

del.php in miniBloggie 1.0 allows remote attackers to delete arbitrary posts via a direct request with a modified postid parameter, a different vulnerability than CVE-2008-4628...

Sql injection

SQL injection vulnerability in del.php in myWebland miniBloggie 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter...

CVE-2008-4628

SQL injection vulnerability in del.php in myWebland miniBloggie 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter...

CVE-2008-4628

SQL injection vulnerability in del.php in myWebland miniBloggie 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter...

CVE-2008-4628: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in del.php in myWebland miniBloggie 1.0 allows remote attackers to execute arbitrary SQL commands via the postid parameter...

CVE-2007-1899

Multiple SQL injection vulnerabilities in myWebland myBloggie 2.1.6 allow remote attackers to execute arbitrary SQL commands via 1 the userid parameter in a viewuser action to index.php, and allow remote authenticated administrators to execute arbitrary SQL commands via 2 the postid parameter in ...

CVE-2007-1899: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in myWebland myBloggie 2.1.6 allow remote attackers to execute arbitrary SQL commands via 1 the userid parameter in a viewuser action to index.php, and allow remote authenticated administrators to execute arbitrary SQL commands via 2 the postid parameter in ...

Sql injection

SQL injection vulnerability in index.php in Archangel Weblog 0.90.02 and earlier allows remote attackers to execute arbitrary SQL commands via the postid parameter...

CVE-2008-2356: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in index.php in Archangel Weblog 0.90.02 and earlier allows remote attackers to execute arbitrary SQL commands via the postid parameter...

minibloggie-delete.txt

MiniBloggie Arbitrary Delete Post Vulnerability Author: Cod3rZ Site: http://cod3rz.helloweb.eu PoC: if isset$GET'postid' $postid = $GET'postid'; if isset$GET'confirm' $confirm = $GET'confirm'; ... elseif $confirm=="yes" ... $sql = "DELETE FROM blogdata WHERE postid=$postid"; $query = mysqlquery$s...