1359 matches found
CVE-2014-5346: Cross-Site Request Forgery (CSRF)
Multiple cross-site request forgery CSRF vulnerabilities in the Disqus Comment System plugin 2.77 for WordPress allow remote attackers to hijack the authentication of administrators for requests that 1 activate or 2 deactivate the plugin via the active parameter to wp-admin/edit-comments.php, 3...
PT-2014-6425
Name of the Vulnerable Software and Affected Versions Disqus Comment System plugin version 2.77 Description The issue affects the Disqus Comment System plugin, allowing remote attackers to hijack the authentication of administrators. This can be achieved through multiple cross-site request forger...
PT-2014-6426
Name of the Vulnerable Software and Affected Versions Disqus Comment System plugin versions prior to 2.76 for WordPress Description The issue allows remote attackers to hijack the authentication of administrators for requests, conducting cross-site scripting XSS attacks. This is achieved via the...
CVE-2014-5201: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the Gallery Objects plugin 0.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the viewid parameter in a goviewobject action to wp-admin/admin-ajax.php...
Sql injection
SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus simple-retail-menus plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php...
CVE-2014-5180
SQL injection vulnerability in the videos page in the HDW Player Plugin hdw-player-video-player-video-gallery 2.4.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the edit action to wp-admin/admin.php...
PT-2014-6319
Name of the Vulnerable Software and Affected Versions HDW Player Plugin hdw-player-video-player-video-gallery version 2.4.2 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the id parameter in the edit action to...
PT-2014-6325
Name of the Vulnerable Software and Affected Versions All Video Gallery plugin version 1.2 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved via the id parameter in an edit action in the "allvideogallery videos" page to...
PT-2014-6322
Name of the Vulnerable Software and Affected Versions Simple Retail Menus plugin versions prior to 4.1 Description The issue allows remote authenticated editors to execute arbitrary SQL commands. This is achieved by exploiting the targetmenu parameter in an edit action to the "wp-admin/admin.php"...
CVE-2014-5180: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the videos page in the HDW Player Plugin hdw-player-video-player-video-gallery 2.4.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in the edit action to wp-admin/admin.php...
PT-2014-6323
Name of the Vulnerable Software and Affected Versions stripShow plugin version 2.5.2 Description The issue allows remote authenticated administrators to execute arbitrary SQL commands. This is achieved by exploiting the story parameter in an edit action to the "wp-admin/admin.php" endpoint...
CVE-2014-5186: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the All Video Gallery all-video-gallery plugin 1.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the id parameter in an edit action in the allvideogalleryvideos page to wp-admin/admin.php...
CVE-2014-5184: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the stripshow-storylines page in the stripShow plugin 2.5.2 for WordPress allows remote authenticated administrators to execute arbitrary SQL commands via the story parameter in an edit action to wp-admin/admin.php...
CVE-2014-5185: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in the Quartz plugin 1.01.1 for WordPress allows remote authenticated users with Contributor privileges to execute arbitrary SQL commands via the quote parameter in an edit action in the quartz/quoteform.php page to wp-admin/edit.php...
CVE-2014-5183: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in includes/mode-edit.php in the Simple Retail Menus simple-retail-menus plugin before 4.1 for WordPress allows remote authenticated editors to execute arbitrary SQL commands via the targetmenu parameter in an edit action to wp-admin/admin.php...
BannerMan 0.2.4 - XSS in wp-admin/options-general.php via bannerman_background parameter
The BannerMan WordPress plugin was affected by a XSS in wp-admin/options-general.php via bannermanbackground parameter security vulnerability...
Member Approval 131109 - wp-admin/options-general.php Option Manipulation CSRF
The member-approval WordPress plugin was affected by a wp-admin/options-general.php Option Manipulation CSRF security vulnerability...
ThinkIT <= 0.2 - wp-admin/admin.php toitcf_current_id Parameter XSS
The ThinkIT WP Contact Form WordPress plugin was affected by a wp-admin/admin.php toitcfcurrentid Parameter XSS security vulnerability...
Marekkis Watermark 0.9.2 - wp-admin/options-general.php pfad Parameter XSS
The Marekkis Watermark-Plugin WordPress plugin was affected by a wp-admin/options-general.php pfad Parameter XSS security vulnerability...