57 matches found
Coditor <= 1.1 - Arbitrary File Edition, Deletion and Internal Directory Listing in wp-content
The coditorprocessajax AJAX call is missing any CSRF and authorisation checks, allowing low privilege users subscriber+ to read and edit any files in the wp-content folder, as well as list its content. PoC The PoC will be displayed once the issue has been remediated...
Media Library Assistant < 2.82 - Unauthenticated Limited Local File Inclusion
The Media Library Assistant plugin before 2.82 for WordPress suffers from a Local File Inclusion vulnerability in mlagallery link=download. PoC The LFI is restricted to the "wp-content" directory...
Zeebsploit - Web Scanner / Exploitation / Information Gathering
zeebsploit is a tool for hacking searching for web information and scanning vulnerabilities of a web Installation & Usage apt-get install git git clone https://github.com/jaxBCD/Zeebsploit.git cd Zeebsploit chmod +x install ./install python3 zeebsploit.py type 'help' for show modules and follow...
Directory traversal
PHP Scripts Mall Advance Crowdfunding Script 2.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...
CVE-2018-20626
PHP Scripts Mall Consumer Reviews Script 4.0.3 has directory traversal via a direct request for a listing of an uploads directory such as the wp-content/uploads/2018/12 directory...
Directory traversal
PHP Scripts Mall Open Source Real-estate Script 3.6.2 allows remote attackers to list the wp-content/themes/templatedpdec2015/img directory...
DEBIAN-CVE-2018-14028
In WordPress 4.9.7, plugins uploaded via the admin area are not verified as being ZIP files. This allows for PHP files to be uploaded. Once a PHP file is uploaded, the plugin extraction fails, but the PHP file remains in a predictable wp-content/uploads location, allowing for an attacker to then...
WordPress Neosense Theme Upload Vulnerability
WordPress is a set of blogging platforms developed using the PHP language by the WordPress Software Foundation.Neosense is a dynamic news theme for WordPress. An upload vulnerability exists in WordPress Neosense Theme. An attacker can exploit this vulnerability to upload arbitrary files to the...
Vane - WordPress Vulnerability Scanner (A GPL fork of WPScan)
Vane is a GPL fork of the now non-free popular WordPress vulnerability scanner WPScan. INSTALL Prerequisites Windows not supported Ruby = 1.9 RubyGems Git Installing on Debian/Ubuntu sudo apt-get install libcurl4-gnutls-dev libopenssl-ruby libxml2 libxml2-dev libxslt1-dev ruby-dev git clone...
Wordpress Theme U-Design Arbitrary File Download Vulnerability
Exploit for php platform in category web applications Exploit Title: Wordpress Theme U-Design Arbitrary File Download Vulnerability Date: 18/01/2015 Exploit Author: t3rr0rist - GHC Georgian Hacking Community team Contact : email protected Tested on: Linux Google Dork:...
CVE-2014-5368
CVE-2014-5368 affects the WordPress WP Content Source Control plugin (versions 3.0.0 and earlier). A directory traversal vulnerability exists in the downloadfiles/download.php script where user-controlled input in the path parameter can be navigated with “..” to trigger read access via file_get_c...
Authentication flaw
The MailPoet Newsletters wysija-newsletters plugin before 2.6.7 for WordPress allows remote attackers to bypass authentication and execute arbitrary PHP code by uploading a crafted theme using wp-admin/admin-post.php and accessing the theme in wp-content/uploads/wysija/themes/mailp/...
Wordpress Plugin plg_novana Sql Injection Vulnerability
WordPress Plg Novana third party plugin suffers from a remote SQL injection vulnerability. Exploit Title : Wordpress plgnovana plugin Sql Injection Exploit Author : Ashiyane Digital Security Team Discovered By : sil3nt Home : www.ashiyane.org Security Risk : High - SQL Injection Dork :...
WordPress SQL Injection(wp-content-simple-forum)
WordPress SQL Injectionwp-content-simple-forum AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DORKS 1 : allinurl :"wp-content/plugins/simple-forum" DORK 2 : allinurl :"simple-forum/ahah" EXPLOIT :...
Wordpress Plugin (wp-content/recipe) SQL Injection
Wordpress Plugin wp-content/recipe SQL Injection AUTHOR : S@BUN HOME : http://www.hackturkiye.com/ DORK 1 : allinurl: "wp-content/recipe" EXPLOIT : wordspew-rss.php?id=-998877//UNION//SELECT//0,1,concat0x7c,userlogin,0x7c,userpass,0x7c,concat0x7c,userlogin,0x7c,userpass,0x7c,4,5//FROM//wpusers...
WordPress MU 1.3.2 - active_plugins option Code Execution
WordPress MU 1.3.2 - activeplugins option Code Execution Website : http://www.buayacorp.com/ Advisory: http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.html This exploit uses activeplugins option to execute arbitrary PHP / includeonce './class-snoopy.php'; // Fix Snoopy cla...
PT-2005-2664 · WordPress · Wordpress
Name of the Vulnerable Software and Affected Versions: Wordpress versions 1.5 and earlier Description: The issue allows remote attackers to obtain sensitive information via a direct request to files in 1 wp-content/themes/, 2 wp-includes/, or 3 wp-admin/, which reveal the path in an error message...