Sql injection

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

CVE-2017-14723

Before version 4.8.2, WordPress mishandled % characters and additional placeholder values in $wpdb-prepare, and thus did not properly address the possibility of plugins and themes enabling SQL injection attacks...

WordPress 2.3.0-4.7.4 - Authenticated SQL injection

Description Due bad solution of the database abstraction library WordPress exposes itself towards SQL Injection and validation bypass. Beside WordPress itself this issue have huge impact towards complete WP ecosystem. Up to WordPress 4.8.1 is vulnerable, but this time attack is dependent from...

Security Advisory - MITM Vulnerability in Huawei Themes App in Some Mobile Phones

The Themes App in some Huawei mobile phones has a man-in-the-middle MITM vulnerability due to the use of the insecure HTTP protocol for theme download. An attacker may exploit this vulnerability to tamper with downloaded themes. Vulnerability ID: HWPSIRT-2017-06263 This vulnerability has been...

Flash Slideshow Maker Professional XSS / Content Forgery / Redirect

================================================================================= | | | | | | | | | | | |/' | / / / / | ' | /| | ' \ \ / | '| \ \ \ /\ / / | | | \ |/ / | | | | |./ / | | ./ /\ V V / || ||/|| || ||/ || / // C O N T A C T : Twitter: @ret2eax Email: [email protected] Blog:...

Information Disclosure

Moodle is vulnerable to information disclosure. For installations that use custom themes that with blocks regions in the layout, a malicious user can view information on inaccessible courses when logging in...

HawkEye Credential Theft Malware Distributed in Recent Phishing Campaign

A wide variety of threat actors began distributing HawkEye malware through high-volume email campaigns after it became available for purchase via a public-facing website. The actors behind the phishing campaigns typically used email themes based on current events and media reports that would piqu...

WordPress Themes Awake Cross-Site Scripting Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in WordPress Themes Awake. A remote attacker can exploit this vulnerability to...

WordPress Themes U-design File Upload Vulnerability

WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A file upload vulnerability exists in WordPress Themes U-design, which can be exploited by an attacker to upload arbitrary...

Wordpress Themes rehber file upload vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their weblogs on servers that support PHP and MySQL databases. A file upload vulnerability exists in Wordpress Themes rehber, which can be exploited by remote attackers to upload arbitrary files...

Multiple Vulnerabilities in Wordpress Themes Ebs

WordPress is a blogging platform developed using the PHP language that allows users to set up their weblogs on servers that support PHP and MySQL databases. A file upload and cross-site request forgery vulnerability exists in Wordpress Themes Ebs, which can be exploited by remote attackers to...

WordPress Easy WP SMTP Cross-Site Scripting Vulnerability

WordPress is a blogging platform developed using the PHP language that allows users to set up their own websites on servers that support PHP and MySQL databases. WordPress can also be used as a content management system CMS. A cross-site scripting vulnerability exists in WordPress Easy WP SMTP...

CVE-2017-8101

There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request...

CVE-2017-8101

There is CSRF in Serendipity 2.0.5, allowing attackers to install any themes via a GET request...

s9y Serendipity Cross Site Request Forgery Vulnerability

Exploit for php platform in category web applications Details ====== Software: s9y Serendipity Version: Mitigations ======= update to Serendipity v2.1.x ======== FIX: ========== https://github.com/s9y/Serendipity/issues/452 Best regards, Zhiyang Zeng of Tencent security platform department...

WordPress Elegant Themes Divi Theme Directory Traversal Nmap NSE Script

local http = require "http" local shortport = require "shortport" local stdnse = require "stdnse" local string = require "string" local vulns = require "vulns" local nmap = require "nmap" description = Directory traversal vulnerability in the Elegant Themes Divi theme for WordPress allows remote...

Wordpress Multimedia1 Themes CSRF Vulnerability

Exploit for php platform in category web applications Wordpress Themes Multimedia1 Shell Upload Vulnerability | CSRF Author : Berandal Google Dork: inurl:/wp-content/themes/multimedia1/ Tested on: Win 7, Linux Blog : http://www.maxteroit.com/ +-+-+-+-+-+-+-+-+ |B|e|r|a|n|d|a|l| +-+-+-+-+-+-+-+-+ ...

Exploit for Path Traversal in Elegantthemes Divi

CVE-2015-1579 - WP Revslider AFD Exploit: Wordpress Slider Re...

DEBIAN-CVE-2017-5611

SQL injection vulnerability in wp-includes/class-wp-query.php in WPQuery in WordPress before 4.7.2 allows remote attackers to execute arbitrary SQL commands by leveraging the presence of an affected plugin or theme that mishandles a crafted post type name...

CSS injection in themes

PMASA-2017-4 Announcement-ID: PMASA-2017-4 Date: 2017-01-24 Summary CSS injection in themes Description It was possible to cause CSS injection in themes by crafted cookie parameters. Severity We consider this to be non critical. Affected Versions All 4.6.x versions prior to 4.6.6, 4.4.x versions...