12 matches found
EUVD-2015-9241
Malware in sbrugna...
CVE-2019-17207: Improper Neutralization of Input During Web Page Generation
A reflected XSS vulnerability was found in includes/admin/table-printer.php in the broken-link-checker aka Broken Link Checker plugin 1.11.8 for WordPress. This allows unauthorized users to inject client-side JavaScript into an admin-only WordPress page via the...
CVE-2015-9398
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection...
CVE-2015-9398: Improper Neutralization of Special Elements used in an SQL Command
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php gcid SQL injection...
CVE-2015-9401: Improper Neutralization of Input During Web Page Generation
The websimon-tables plugin through 1.3.4 for WordPress has wp-admin/tools.php editstyle id XSS...
CVE-2015-9397: Improper Neutralization of Input During Web Page Generation
The gocodes plugin through 1.3.5 for WordPress has wp-admin/tools.php deletegc XSS...
CVE-2016-10983: Improper Authentication
The ghost plugin before 0.5.6 for WordPress has no access control for wp-admin/tools.php?ghostexport=true downloads of exported data...
CVE-2016-10944: Cross-Site Request Forgery (CSRF)
The multisite-post-duplicator plugin before 1.1.3 for WordPress has wp-admin/tools.php?page=mpd CSRF...
CVE-2017-18603: Improper Neutralization of Input During Web Page Generation
The postman-smtp plugin through 2017-10-04 for WordPress has XSS via the wp-admin/tools.php?page=postmanemaillog page parameter...
CVE-2013-6993: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Ad-minister plugin 0.6 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the key parameter in a delete action to wp-admin/tools.php...
CVE-2013-6991: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the WP-Cron Dashboard plugin 1.1.5 and earlier for WordPress allows remote attackers to inject arbitrary web script or HTML via the procname parameter to wp-admin/tools.php...
CVE-2012-2916: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in sabreclassadmin.php in the SABRE plugin before 2.1 for WordPress allows remote attackers to inject arbitrary web script or HTML via the activeoption parameter to wp-admin/tools.php...