Recent Posts Widget Extended <= 0.9.9.3 - Authenticated XSS (multisite)

XSS in the Recent Posts Widget Extended plugin allows single site admins to change network admin's password with simple CSRF described above POC field. This vulnerability is currently unpatched. 1. Login as single site administrator 2. Add Recent Posts Extended Widget to some widget area 3. Add...

WordPress Recent Posts Widget Extended Plugin <= 0.9.9.3 - Authenticated XSS

Because of this vulnerability, the attackers can inject arbitrary web script or HTML. Solution Upgrade the plugin...

CVE-2015-2872

Multiple cross-site scripting XSS vulnerabilities in Trend Micro Deep Discovery Inspector DDI on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web...

Cross site scripting

Multiple cross-site scripting XSS vulnerabilities in Trend Micro Deep Discovery Inspector DDI on Deep Discovery Threat appliances with software before 3.5.1477, 3.6.x before 3.6.1217, 3.7.x before 3.7.1248, 3.8.x before 3.8.1263, and other versions allow remote attackers to inject arbitrary web...

WordPress Social Media Widget Plugin <= 2.2 - Cross Site Scripting

Because of this vulnerability, the attackers can inject arbitrary JavaScript or HTML code. Solution Update the plugin...

CVE-2015-5499

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

Code injection

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

CVE-2015-5499

The Navigate module for Drupal does not properly check permissions, which allows remote authenticated users to modify custom widgets and create widget database records by leveraging the "navigate view" permission...

DLA-294-1 wordpress - security update

Bulletin has no description...

[SECURITY] [DSA 3332-1] wordpress security update

------------------------------------------------------------------------- Debian Security Advisory DSA-3332-1 [email protected] https://www.debian.org/security/ Thijs Kinkhorst August 11, 2015 https://www.debian.org/security/faq -...

WordPress Plugin Recent Backups 0.7 - Arbitrary File Download

Title: Remote file download vulnerability in recent-backups v0.7 wordpress plugin Author: Larry W. Cashdollar, @larry0 Date: 2015-07-13 Download Site: https://wordpress.org/plugins/recent-backups Vendor: https://profiles.wordpress.org/andycheeseman/ Vendor Notified: 0000-00-00 Vendor Contact:...

Altos Connect Widget <= 1.3.0 - Unauthenticated Cross-Site Scripting (XSS)

The altos-connect WordPress plugin was affected by an Unauthenticated Cross-Site Scripting XSS security vulnerability. PoC http://www.example.com/wp-content/plugins/altos-connect/jquery-validate/demo/demo/captcha/index.php/"...

WordPress Altos Connect Widget 1.3.0 Cross Site Scripting Vulnerability

WordPress Altos Connect Widget plugin version 1.3.0 suffers from a cross site scripting vulnerability. Title: WordPress 'Altos Connect Widget' Plugin Version: 1.3.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-15 Download: - https://wordpress.org/plugins/altos-connect/ -...

WordPress Altos Connect Widget Plugin <= 1.3.0 - Cross Site Scripting (XSS)

This plugin is prone to a cross site scripting vulnerability, because "PHPSELF" is printed without sanitization in a captcha demo page. Solution Update the plugin...

WordPress <= 4.2.3 - XSS #2

This vulnerability exists in the WPNavMenuWidget class in wp-includes/default-widgets.php in the "form" function. It allows remote attackers to inject arbitrary web script or HTML via a widget title. Related records: http://db.threatpress.com/vulnerability/wordpress/wordpress-4-2-3-xss Solution...

WordPress Altos Connect Widget 1.3.0 Cross Site Scripting

Title: WordPress 'Altos Connect Widget' Plugin Version: 1.3.0 Author: Morten Nørtoft, Kenneth Jepsen & Mikkel Vej Date: 2015-06-15 Download: - https://wordpress.org/plugins/altos-connect/ - https://plugins.svn.wordpress.org/altos-connect/ Notified WordPress: 2015-06-21...

Oracle Application Express Cross Site Scripting Vulnerability

Exploit for multiple platform in category web applications title: Permanent Cross-Site Scripting product: Oracle Application Express vulnerable version: All versions prior to 4.2.3.00.08 fixed version: 4.2.3.00.08 CVE number: CVE-2015-2655 impact: high homepage: https://apex.oracle.com/i/index.ht...

SQL Injection Vulnerability in Widget Parameters of Hangzhou Elite Online Education Technology Online Learning Platform

Hangzhou Elite Online Education Technology Online Learning Platform is an education and training platform. A SQL injection vulnerability exists in the widget parameters of the WidgetsHandler.ashx page of the Hangzhou Elite Online Education Technology online learning platform. Comprehensive...

CVE-2015-4084 - WordPress Free Counter Plugin [Stored XSS]

Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link: https://wordpress.org/plugins/free-counter/ Version: 1.1 Tested on: WordPress 4.2.2...

WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting

WordPress Plugin Free Counter 1.1 - Persistent Cross-Site Scripting Exploit Title: WordPress Free Counter Plugin Stored XSS Date: 2015/05/25 Exploit Author: Panagiotis Vagenas Contact: https://twitter.com/panVagenas Vendor Homepage: http://www.free-counter.org Software Link:...