Automattic: Remote Code Execution in Wordpress Desktop

An attacker can create a malicious page that when viewed or edited in Wordpress Desktop App will results in remote code execution. This issue looks to be around this line of code: https://github.com/Automattic/wp-desktop/blob/develop/desktop/window-handlers/external-links/index.jsL38 If...

Enter: [CRITICAL]-Taking over entire subdomain of romit.io

Hi, During recon, I found out that blog.romit.io was not mapped with wordpress.com and the domain was returning back error like this domain has not been mapped with wordpress.com, to map it please login into wordpres.com. So, I quickly created an account on wordpress.com and mapped blog.romit.io ...

Archos 5/Archos OS 2.0.45 Media Centre GIF Denial Of Service Exploit

Exploit for windows platform in category dos / poc include using namespace std; / ---------------------------------------------------------------- 888 .d8888b. 888 d88P Y88b 888 .d88P .d8888b .d88b. 88888b.d88b. 88888b. 888 8888" 888 888 d88P" d88""88b 888 "888 "88b 888 "88b 888 "Y8b. Y8bd8P' 888...

WordPress DDoS Attacks Primarily From China !

After recovering from the largest Distributed Denial of Service attack in the service's history "multiple Gigabits per second and tens of millions of packets per second" yesterday morning, blog host WordPress.com was attacked again very early this morning, finally stabilizing its service at 11:15...

WordPress under massive DDoS attack !

Readers of Financial Post or National Post blogs might have found them difficult, if not impossible, to access Thursday morning. That is because WordPress, the platform through which every FP and NP blog has been published for the past 10 months, has been under attack by hackers for the past...

WordPress. com permanent XSS vulnerability-vulnerability warning-the black bar safety net

UPDATE: Drew Strojny, the Vigilance theme creator ask me to hide the post until a he publish a fixed version. He did yesterday so I put this post online again. Friday 3 I discovered XSS the vulnerability into WordPress.com. A malicious attacker can insert Javascript into the “Alert Box” feature o...

weenCompany - SQL Injection

weenCompany - SQL Injection weenCompany SQL Injection Vulnerability Vendor: http://www.weentech.com/ Author: Gamoscu Site: www.1923turk.biz Site: http://gamoscu.wordpress.com/ Dork:"Created by weenCompany" Exploit: http://server/index.php?moduleid=m2newsSQL-inj&articleid=1 Greetz: Manas58 Baybora...