Rimons Twitter Widget < 1.3 - XSS

The Rimons Twitter Widget WordPress plugin was affected by a XSS security vulnerability...

CVE-2017-7719

SQL injection in the Spider Event Calendar aka spider-event-calendar plugin before 1.5.52 for WordPress is exploitable with the orderby parameter to calendarfunctions.php or widgetThemefunctions.php, related to frontend/frontendfunctions.php...

WordPress Ad Widget <= 2.11.0 - Authenticated Local File Inclusion (LFI)

The WordPress Ad Widget WordPress plugin was affected by an Authenticated Local File Inclusion LFI security vulnerability. http://www.example.com/wp-content/plugins/ad-widget/views/modal/index.php?step=php://filter/convert.base64-encode/resource=../wp-config...

WordPress Ad Widget <= 2.11.0 - Authenticated Local File Inclusion (LFI)

The WordPress Ad Widget WordPress plugin was affected by an Authenticated Local File Inclusion LFI security vulnerability. PoC http://www.example.com/wp-content/plugins/ad-widget/views/modal/index.php?step=php://filter/convert.base64-encode/resource=../wp-config...

CVE-2016-9126

Revive Adserver before 3.2.3 suffers from persistent XSS. Usernames are not properly escaped when displayed in the audit trail widget of the dashboard upon login, allowing persistent XSS attacks. An authenticated user with enough privileges to create other users could exploit the vulnerability to...

CVE-2016-9126

Affected software: Revive Adserver prior to 3.2.3. Issue: persistent XSS in the audit trail widget on login due to inadequate escaping of usernames; an authenticated user who can create other users could leverage this to access the administrator account. Impact (per sources): CVSS metrics show ba...

Trend Micro Control Manager Widget importFile.php Directory Traversal

A directory traversal vulnerability has been reported in Trend Micro Control Manager. This vulnerability is caused by improper sanitization of directory traversal characters by importFile php. A remote, unauthenticated attacker could exploit this vulnerability by uploading arbitrary files onto th...

HashOver Cross-Site Scripting Vulnerability

HashOver is a free and open source PHP-based commenting system. A cross-site scripting vulnerability exists in HashOver version 2.0, which stems from the program's failure to adequately filter user data submitted to the 'hashover/scripts/widget-output.php' URL. A remote attacker could exploit thi...

CVE-2017-6395

An issue was discovered in HashOver 2.0. The vulnerability exists due to insufficient filtration of user-supplied data passed to the 'hashover/scripts/widget-output.php' URL. An attacker could execute arbitrary HTML and script code in a browser in the context of the vulnerable website...

Pornhub: http://ht.pornhub.com/ stored XSS in widget stylesheet

The researcher discovered a way to include JavaScript content through the CSS editor by leveraging the expression dynamic property...

USN-3203-1: gtk-vnc vulnerabilities

It was discovered that gtk-vnc incorrectly validated certain data. A malicious server could use this issue to cause gtk-vnc to crash, resulting in a denial of service, or possibly execute arbitrary code...

Contacts+ Widget - Customized SSL, Dynamic Code Loading, External URLs vulnerabilities

HackApp vulnerability scanner discovered that application Contacts+ Widget published at the 'play' market has multiple vulnerabilities...

Trend Micro Control Manager modDLPViolationCnt_drildown Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within widget's modDLPViolationCntdrildown.php script. The issue lies in the lack...

Trend Micro Control Manager modDLPTemplateMatch_drildown Directory Traversal Remote Code Execution Vulnerability

This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Trend Micro Control Manager. Authentication is not required to exploit this vulnerability. The specific flaw exists within widget's modDLPTemplateMatchdrildown.php script. The issue lies in the lac...

WordPress Cross-Site Request Forgery Vulnerability (CNVD-2017-00613)

WordPress is a blogging platform developed using the PHP language by the WordPress Software Foundation. The platform supports setting up personal blog sites on servers with PHP and MySQL. A cross-site request forgery vulnerability exists in the widget-editingaccessibility-mode feature in WordPres...

CVE-2017-5492

Cross-site request forgery CSRF vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php...

DEBIAN-CVE-2017-5492

Cross-site request forgery CSRF vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php...

UBUNTU-CVE-2017-5492

Cross-site request forgery CSRF vulnerability in the widget-editing accessibility-mode feature in WordPress before 4.7.1 allows remote attackers to hijack the authentication of unspecified victims for requests that perform a widgets-access action, related to wp-admin/includes/class-wp-screen.php...

Reflected Cross-Site Scripting Vulnerability in WordPress Plugin Zhina Twitter Widget

WordPress is a blogging platform developed using the PHP language, which supports personal blog sites on servers with PHP and MySQL. A reflective cross-site scripting vulnerability exists in the WordPress plugin Zhina Twitter Widget 'phoenixsearch.php' page, which can be exploited by attackers to...