29 matches found
CVE-2011-5270: Undefined Security Weakness
wp-admin/press-this.php in WordPress before 3.0.6 does not enforce the publishposts capability requirement, which allows remote authenticated users to perform publish actions by leveraging the Contributor role...
WordPress 'press-this.php'远程安全绕过漏洞
Bugtraq ID: 47598 WordPress是一款流行的blog系统。 在发布帖子时wp-admin/press-this.php脚本不正确检查用户权限，用户可无需"publishposts"权限发布文章。 要成功利用此漏洞需要"Contributor-level"特权。 WordPress WordPress 3.1.1 WordPress WordPress 3.0.5 WordPress WordPress 3.0.4 WordPress WordPress 3.0.3 WordPress WordPress 3.0.2 WordPress WordPress 2.9.2...
CVE-2009-3891
Cross-site scripting XSS vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter aka the selection variable...
CVE-2009-3891
Cross-site scripting XSS vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter aka the selection variable...
CVE-2009-3891: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticated users to inject arbitrary web script or HTML via the s parameter aka the selection variable...
wordpress -- multiple vulnerabilities
secunia reports: The security issue is caused due to the wpcheckfiletype function in /wp-includes/functions.php improperly validating uploaded files. This can be exploited to execute arbitrary PHP code by uploading a malicious PHP script with multiple extensions. Successful exploitation of this...
WordPress <= 2.8.5 - XSS
Because of this vulnerability in wp-admin/press-this.php, authenticated users can inject arbitrary web script or HTML via the "s" parameter. Solution Update WordPress...
WordPress 'press-this.php'多个跨站脚本漏洞
BUGTRAQ ID: 30238 CNCAN ID：CNCAN-2008071709 WordPress是一款流行的博客应用程序。 WordPress 'press-this.php'存在输入验证问题，远程攻击者可以利用漏洞进行跨站脚本攻击，获得敏感信息。 问题是'press-this.php'对多个字段缺少过滤，构建恶意脚本代码作为参数数据，并诱使用户访问，可导致恶意脚本代码在目标浏览器中执行，泄漏敏感信息。 WordPress WordPress 2.5.1 WordPress WordPress 2.3.3 WordPress WordPress 2.3.2 WordPress...
