3376 matches found
CVE-2018-5776
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement under wp-includes/js/mediaelement...
CVE-2018-5776
WordPress before 4.9.2 has XSS in the Flash fallback files in MediaElement under wp-includes/js/mediaelement...
woocommerce-csvimport 3.3.6 – Authenticated Arbitrary File Deletion
Type user access: any user registered. $POST'filename' is not escaped. Code File: wp-content/plugins/woocommerce-csvimport/export/include/classes/woocsvExport.php Line:64 public function deleteexportfile if isset $POST'filename' @unlink $POST'filename' ; wpdie 0 ; Result: wp-config.php file delet...
WordPress Smart Marketing SMS And Newsletters Forms 1.1.1 XSS
Class Input Validation Error Remote Yes Credit Ricardo Sanchez Vulnerable Smart Marketing SMS and Newsletters Forms 1.1.1 Smart Marketing SMS and Newsletters Forms is prone to a stored cross-site scripting vulnerability because it fails to sufficiently sanitize user-supplied data. An attacker may...
InLinks 1.0 - Authenticated SQL Injection
SQL injection is POST parameter "keyword" Affected file inlinks/inlinks.php Affected lines: 58 $Keyword = trim$POST'keyword'; 59 $URL = trim$POST'url'; 60 $Rel = trim$POST'rel'; 61 $Target = trim$POST'target'; 62 $tablename = $wpdb-prefix ."URLKeywordsMapping"; 63 $SelectKeywordURLMappingDetails ...
A week in security (October 30 – November 5)
Last week on our blog, we told you what to expect at the upcoming Irisscon security conference in Dublin. We gave you a quick introduction into the why and how of analyzing malware based on their API calls. And we issued a warning about some lesser-known cybercrimes. Plus we explained why emergin...
CVE-2012-6707
WordPress through 4.8.2 uses a weak MD5-based password hashing algorithm, which makes it easier for attackers to determine cleartext values by leveraging access to the hash values. NOTE: the approach to changing this may not be fully compatible with certain use cases, such as migration of a...
Content Timeline <= 4.4.2 - Multiple Blind SQL Injection
Multiple Blind SQL injections in the premium 'Content Timeline' Plugin. One unauthenticated and two authenticated injections. Contacted the author twice without any response. History: 09-16-2017 Contacted the author 09-16-2017 Requested CVE-ID 09-18-2017 CVE-ID Received 09-18-2017 Contacted the...
CVE-2017-14722
Before version 4.8.2, WordPress allowed a Directory Traversal attack in the Customizer component via a crafted theme filename...
DLA-1096-1 wordpress-shibboleth - security update
Bulletin has no description...
DLA-1075-1 wordpress - security update
Bulletin has no description...
Fedora 26 : wordpress (2017-fe7c3c9c30)
WordPress 4.7.5 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.7.4 and earlier are affected by six security issues : - Insufficient redirect validation in the HTTP class. Reported by Ronni...
DSA-3870-1 wordpress - security update
Bulletin has no description...
CVE-2017-9061
In WordPress before 4.7.5, a cross-site scripting XSS vulnerability exists when attempting to upload very large files, because the error message does not properly restrict presentation of the filename...
WordPress Core 4.6 Unauthenticated Remote Code Execution
==================================================== - Discovered by: Dawid Golunski @dawidgolunski - dawidatlegalhackers.com - https://legalhackers.com - ExploitBox.io @ExploitBox - CVE-2016-10033 - Release date: 03.05.2017 - Revision 2.0 - Last update: 04.05.2017 - Severity: Critical...
WPSeku - Simple Wordpress Security Scanner
WPSeku is a black box WordPress vulnerability scanner that can be used to scan remote WordPress installations to find security issues. Usage | | \ \ /\ / / ' / |/ \ |/ / | | | \ V V /| | \ \ / | || | // | ./|/||\,| || -- WPSeku - Wordpress Security Scanner -- WPSeku - v0.1.0 -- Momo Outaadi...
WPForce - Wordpress Attack Suite
WPForce is a suite of Wordpress Attack tools. Currently this contains 2 scripts - WPForce, which brute forces logins via the API, and Yertle, which uploads shells once admin credentials have been found. Yertle also contains a number of post exploitation modules. For more information, visit the bl...
Fedora 25 : wordpress (2017-d215a25e41)
WordPress 4.7.3 is now available. This is a security release for all previous versions and we strongly encourage you to update your sites immediately. WordPress versions 4.7.2 and earlier are affected by six security issues : - Cross-site scripting XSS via media file metadata. Reported by Chris...
