5205 matches found
CVE-2017-12199
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...
Design/Logic Flaw
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component...
CVE-2017-12199
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...
CVE-2017-12200
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component...
CVE-2017-12199
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...
CVE-2017-12200
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component...
CVE-2017-12199
The CVE-2017-12199 entry documents a SQL injection in the WordPress plugin Etoile Ultimate Product Catalog (version 4.2.11). The vulnerability arises via multiple wp-admin/admin-ajax.php POST actions (catalogue_update_order, list-item, video_update_order, image_update_order, tag_group_update_orde...
CVE-2017-12200
The CVE-2017-12200 entry concerns the WordPress plugin Etoile Ultimate Product Catalog (version 4.2.11). A cross-site scripting (XSS) vulnerability exists in the Add Product Manually component, enabling a remote attacker to inject arbitrary web script or HTML. Details across sources confirm the a...
Joomla Ultimate Property Listing 1.0.2 Component - SQL Injection Vulnerability
Exploit for php platform in category web applications Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection Dork: N/A Date: 02.08.2017 Vendor : http://faboba.com/ Software:...
Joomla! Component Ultimate Property Listing 1.0.2 - SQL Injection
Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection Dork: N/A Date: 02.08.2017 Vendor : http://faboba.com/ Software: https://extensions.joomla.org/extensions/extension/vertical-markets/real-estate/ultimate-property-listing/ Demo: http://demoupl.faboba.com/ Version:...
Joomla! Component Ultimate Property Listing 1.0.2 - SQL Injection
Joomla! Component Ultimate Property Listing 1.0.2 - SQL Injection Exploit Title: Joomla! Component Ultimate Property Listing v1.0.2 - SQL Injection Dork: N/A Date: 02.08.2017 Vendor : http://faboba.com/ Software:...
PT-2017-12397
Name of the Vulnerable Software and Affected Versions Etoile Ultimate Product Catalog plugin version 4.2.11 Description The issue concerns SQL injection in the Etoile Ultimate Product Catalog plugin for WordPress. Specifically, the vulnerability is triggered by various POST actions in the...
PT-2017-12399
Name of the Vulnerable Software and Affected Versions Etoile Ultimate Product Catalog plugin version 4.2.11 Description The issue concerns a problem with the Add Product Manually component, where there is XSS. Recommendations For version 4.2.11, update to a version that fixes this issue, if...
CVE-2017-12200: Improper Neutralization of Input During Web Page Generation
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has XSS in the Add Product Manually component...
CVE-2017-12199: Improper Neutralization of Special Elements used in an SQL Command
The Etoile Ultimate Product Catalog plugin 4.2.11 for WordPress has SQL injection with these wp-admin/admin-ajax.php POST actions: catalogueupdateorder list-item, videoupdateorder video-item, imageupdateorder list-item, taggroupupdateorder listitem, categoryproductsupdateorder...
WordPress Ultimate Affiliate Pro Plugin Cross-Site Scripting Vulnerability
WordPress is a set of WordPress Software Foundation's blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A cross-site scripting vulnerability exists in the WordPress Ultimate Affiliate Pro plugin. An attacker can exploit this...
WordPress Ultimate Affiliate Pro 3.6 Cross Site Scripting
Exploit Title: Ultimate Affiliate Pro WordPress Plugin Edit Account. Write the payload in the 'Last Name' input area: jaVasCript:/-///'/"/// /oNMouseoVer=alertdocument.domain Other fields may be vulnerable. Authenticated Stored XSS: Logged as an affiliate, a low privileged user. Marketing...
WordPress Ultimate Affiliate Pro plugin <=3.6 - Authenticated Stored Cross-site scripting (XSS) vulnerability
Authenticated Stored Cross-site scripting XSS vulnerability found by 8bitsec in premium WordPress Ultimate Affiliate Pro plugin version 3.6 and earlier versions. Cross-site scripting possible when logged in as an affiliate. Solution 2017.07.29 - We were unable to find information about patched...
WordPress Shortcodes Ultimate Plugin Authenticated Directory Traversal (CVE-2017-2245)
A directory traversal vulnerability exists in WordPress Shortcodes Ultimate Plugin. An authenticated user with admin privileges could exploit this vulnerability by sending specially crafted requests. Successful exploitation may result in an information disclosure...