CVE-2017-15810: Improper Neutralization of Input During Web Page Generation

The PopCash.Net Code Integration Tool plugin before 1.1 for WordPress has XSS via the tab parameter to wp-admin/admin.php...

Piwigo Remote File Inclusion Vulnerability

Piwigo is a photo album script written in PHP. A security vulnerability exists in the admin/languages.php implementation in versions prior to Piwigo 2.8.3, where a remote administrator user passes the tab parameter and the executable file contains an attack...

CVE-2016-10085

admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter...

CVE-2016-10085: Improper Access Control

admin/languages.php in Piwigo through 2.8.3 allows remote authenticated administrators to conduct File Inclusion attacks via the tab parameter...

wordpress comment-rating-plugin edit-comments.php文件tab参数跨站脚本漏洞

No description provided by source...

WordPress Comment Rating 1.5.0 Cross Site Scripting

FULL DISCLOSURE Product : wp-comment-rating Exploit Author : Rahul Pratap Singh Version : 1.5.0 Home page Link : http://codecanyon.net/item/wordpress-comment-rating-plugin/6582710 Website : 0x62626262.wordpress.com Linkedin : https://in.linkedin.com/in/rahulpratapsingh94 Date : 30/Jan/2016 XSS...

Calls to Action WordPress Plugin Reflective Cross-Site Scripting Vulnerability

Calls to Action is a plugin for calling events on WordPress sites. Calls to Action 2.4.3 and earlier versions do not effectively filter the "open-tab" HTTP GET parameter value and the "wp-cta-variation-id" HTTP GET parameter value, which allows an unauthenticated, remote attacker to trick...

WordPress GD bbPress Attachments Plugin Directory Traversal Vulnerability

WordPress is the WordPress Software Foundation's set of blogging platform developed using the PHP language, the platform supports the PHP and MySQL server to set up a personal blog site. gd bbPress Attachments is one of the support for uploading attachments to the bbPress open-source forum progra...

CVE-2015-5481

Cross-site scripting XSS vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

Directory traversal

Directory traversal vulnerability in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote administrators to include and execute arbitrary local files via a .. dot dot in the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

Cross site scripting

Cross-site scripting XSS vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

CVE-2015-5481

The CVE-2015-5481 entry documents a Cross-site scripting (XSS) vulnerability in the GD bbPress Attachments WordPress plugin. Affects versions prior to 2.3, vulnerable code resides in forms/panels.php where the tab parameter of gdbbpress_attachments (on wp-admin/edit.php) is not properly filtered,...

CVE-2015-5481

Cross-site scripting XSS vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

PT-2015-6936

Name of the Vulnerable Software and Affected Versions GD bbPress Attachments plugin versions prior to 2.3 Description A cross-site scripting XSS issue exists, allowing remote attackers to inject arbitrary web script or HTML. This is achieved by manipulating the tab parameter in the gdbbpress...

CVE-2015-5481: Improper Neutralization of Input During Web Page Generation

Cross-site scripting XSS vulnerability in forms/panels.php in the GD bbPress Attachments plugin before 2.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter in the gdbbpressattachments page to wp-admin/edit.php...

PT-2015-6937

Name of the Vulnerable Software and Affected Versions GD bbPress Attachments plugin versions prior to 2.3 Description The issue allows remote administrators to include and execute arbitrary local files. This can be achieved by using a .. dot dot in the tab parameter in the "gdbbpress attachments"...

Novius OS Directory Traversal Vulnerability

Novius OS is an open source PHP-based content management system CMS. A directory traversal vulnerability exists in Novius OS version 5.0.1. A remote attacker can use the directory traversal character '...' in the 'tab' parameter of the novius-os/admin/ URI to The vulnerability can be exploited to...

CVE-2015-5353: Improper Limitation of a Pathname to a Restricted Directory

Directory traversal vulnerability in Novius OS 5.0.1 Elche allows remote attackers to include and execute arbitrary local files via a .. dot dot in the tab parameter to admin/...

CVE-2013-4626

Cross-site scripting XSS vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php...

PT-2013-5105

Name of the Vulnerable Software and Affected Versions BackWPup plugin versions prior to 3.0.13 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the tab parameter to "wp-admin/admin.php". Recommendations For versions prior to 3.0.13,...