CVE-2007-1897

SQL injection vulnerability in xmlrpc xmlrpc.php in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the postid variable...

Path Disclosure - Wordpress 2.1.2

Product : Wordpress 2.1.2 Vulnerability Details : All the sites running on the latest version of wordpress 2.1.2 are exposed to a full path disclosure vulnerability. Proof of Concept: http://www.anysite.com/Pathtowordpress/wp-includes/vars.php Error Returned: Fatal error: Call to undefined functi...

CVE-2007-1244

Cross-site request forgery CSRF vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting X...

DTSA-34-1 wordpress - cross-site scripting

Bulletin has no description...

DTSA-33-1 wordpress - multiple vulnerabilities

Bulletin has no description...

WordPress Core 2.0.6 - 'wp-trackback.php' SQL Injection

126 $result.=" ."; else $result.=" ".$string$i; if strlendechexord$string$i==2 $exa.=" ".dechexord$string$i; else $exa.=" 0".dechexord$string$i; $cont++;if $cont==15 $cont=0; $result.="\r\n"; $ex...

wordpress absolute path disclosure+analysis-vulnerability warning-the black bar safety net

Inadvertently change on storm path, it should be all versions are tested the official version and several beta version, the specific version of the exploit code where the line number is different, and is an array and the variables of the old issues, I believe that many places are also there. The...

CVE-2007-0109

wp-login.php in WordPress 2.0.5 and earlier displays different error messages if a user exists or not, which allows remote attackers to obtain sensitive information and facilitates brute force attacks...

CVE-2006-6017

WordPress before 2.0.5 does not properly store a profile containing a string representation of a serialized object, which allows remote authenticated users to cause a denial of service application crash via a string that represents a 1 malformed or 2 large serialized object, because the object...

CVE-2006-5705

Multiple directory traversal vulnerabilities in plugins/wp-db-backup.php in WordPress before 2.0.5 allow remote authenticated users to read or overwrite arbitrary files via directory traversal sequences in the 1 backup and 2 fragment parameters in a GET request...

WordPress < 2.0.3 Arbitrary Code Injection

Binary data 3647.prm...

WordPress < 2.0.1 Arbitrary Script Injection

Binary data 3435.prm...

wpcmdexec.pl.txt

!/usr/bin/perl -w Wordpress 1.5.1.2 Strayhorn // XMLRPC Interface SQL Injection By James Bercegay // http://www.gulftech.org/ // June 21 2005 Quick and dirty proof of concept that uses the XML RPC server vulnerabilities I discovered to extract a password hash & use that hash to execute shell...

wordpress1512.txt

GulfTech Security Research June 28th, 2005 Vendor : WordPress URL : http://wordpress.org/ Version : WordPress 1.5.1.2 && Earlier Risk : Multiple Vulnerabilities Description: WordPress is a very popular personal publishing platform aka blog software, and is used by everyone from celebrities, to...

WordPress 1.2.11.2.2 - wp-admintemplates.php?file Cross-Site Scripting

WordPress 1.2.11.2.2 - wp-admintemplates.php?file Cross-Site Scripting source: https://www.securityfocus.com/bid/11984/info Wordpress is reported vulnerable to multiple cross-site scripting, HTML injection, and SQL injection vulnerabilities. These issues are due to a lack of proper sanitization o...

WordPress 'wp-login.php' HTTP Response Splitting

According to its banner, the remote version of WordPress is vulnerable to an HTTP-splitting attack wherein an attacker can insert CR LF characters and then entice an unsuspecting user into accessing the URL. The client will parse and possibly act on the secondary header which was supplied by the...

WordPress Core 1.2 - 'bookmarklet.php' Multiple Cross-Site Scripting Vulnerabilities

source: https://www.securityfocus.com/bid/11268/info It is reported that Wordpress is affected by various cross-site scripting vulnerabilities. These issues are due to a failure of the application to properly sanitize user-supplied URI input. Wordpress 1.2 is reported vulnerable, however, other...