82 matches found
CVE-2018-7491
In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor 'Content-Security-Policy "frame-ancestors'...
CVE-2018-7491
In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor 'Content-Security-Policy "frame-ancestors'...
PT-2018-18101
Name of the Vulnerable Software and Affected Versions PrestaShop versions prior to 1.7.2.5 Description A UI-Redressing/Clickjacking issue was discovered, potentially leading to state-changing impact in the context of a user or an admin. This is because the generateHtaccess function in...
CVE-2018-7491: Improper Restriction of Rendered UI Layers or Frames
In PrestaShop through 1.7.2.5, a UI-Redressing/Clickjacking vulnerability was found that might lead to state-changing impact in the context of a user or an admin, because the generateHtaccess function in classes/Tools.php sets neither X-Frame-Options nor 'Content-Security-Policy "frame-ancestors'...
Wordpress Plugin Multisite Post Duplicator Cross-Site Request Forgery Vulnerability
WordPress is the WordPress Software Foundation of a set of blogging platform developed using the PHP language , the platform supports PHP and MySQL server set up a personal blog site . A cross-site request forgery vulnerability exists in the tools.php page of version 0.9.5.1 of the Wordpress plug...
WordPress Simple Backup plugin 'tools.php' arbitrary file download vulnerability
WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A security vulnerability exists in the WordPress Simple Backup plugin. An attacker exploits this vulnerability to download arbitrary files in the context of a web...
Redirection - wp-admin/tools.php id Parameter XSS
The Redirection WordPress plugin was affected by a wp-admin/tools.php id Parameter XSS security vulnerability...
Cross site scripting
Cross-site scripting XSS vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the procname parameter to wp-admin/tools.php...
CVE-2013-6993
Cross-site scripting XSS vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php...
CVE-2013-6993: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php...
PT-2014-3241
Name of the Vulnerable Software and Affected Versions WP-Cron Dashboard plugin versions 1.1.5 and earlier Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML via the procname parameter to "wp-admin/tools.php". Recommendations For WP-Cron Dashboa...
PT-2014-3243
Name of the Vulnerable Software and Affected Versions Ad-minister plugin versions 0.6 and earlier for WordPress Description The issue allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to "wp-admin/tools.php". This is a cross-site scripting XSS...
CVE-2013-6991: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the procname parameter to wp-admin/tools.php...
WordPress Ad-Minister Plugin <= 0.6 - XSS
Because of this vulnerability, the attackers can inject arbitrary web script or HTML via the "key" parameter in a delete action to wp-admin/tools.php. Solution Update the plugin...
CVE-2011-4639: Improper Control of Generation of Code
The 1 Traceroute and 2 Ping implementations in tools.php in SpamTitan WebTitan before 3.60 allow remote authenticated users to execute arbitrary commands via shell metacharacters in an argument, as demonstrated by an && ampersand ampersand sequence...
PT-2012-1934
Name of the Vulnerable Software and Affected Versions SpamTitan WebTitan versions prior to 3.60 Description The issue concerns the Traceroute and Ping implementations in tools.php, allowing remote authenticated users to execute arbitrary commands via shell metacharacters in an argument. This can ...
PT-2012-4362
Name of the Vulnerable Software and Affected Versions SABRE plugin versions prior to 2.1 for WordPress Description The issue is related to a cross-site scripting XSS vulnerability. This vulnerability allows remote attackers to inject arbitrary web script or HTML via the active option parameter to...
CVE-2012-2916: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in sabreclassadmin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the activeoption parameter to wp-admin/tools.php...
CVE-2009-4466: Exposure of Sensitive Information to an Unauthorized Actor
DeluxeBB 1.3 allows remote attackers to obtain sensitive information via a crafted page parameter to misc.php, which reveals the installation path in an error message. NOTE: this issue might be resultant from improperly controlled computation in tools.php that leads to a denial of service CPU or...
CVE-2009-3418: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Plume CMS 1.2.3 allow 1 remote authenticated users to execute arbitrary SQL commands via the m parameter to manager/index.php and 2 remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an editlink action to...