VulnCheck KEV: CVE-2021-24227

The Jetpack Scan team identified a Local File Disclosure vulnerability in the Patreon WordPress plugin before 1.7.0 that could be abused by anyone visiting the site. Using this attack vector, an attacker could leak important internal files like wp-config.php, which contains database credentials a...

WordPress plugin Download Monitor 安全漏洞

WordPress and WordPress plugin are both products of the WordPress Foundation.WordPress is a blogging platform developed using the PHP language. The platform supports setting up personal blog sites on servers with PHP and MySQL.WordPress plugin is an application plugin. An arbitrary file download...

CVE-2021-24367

CVE-2021-24367 affects the WordPress plugin WP Config File Editor up to version 1.7.1, which contains an Authenticated Stored Cross-Site Scripting (XSS) flaw. The vulnerability arises within the plugin’s admin-facing functionality; exploitation requires authentication (typically an admin). A PoC ...

CVE-2021-24367: Improper Neutralization of Input During Web Page Generation

The WP Config File Editor WordPress plugin through 1.7.1 was affected by an Authenticated Stored Cross-Site Scripting XSS vulnerability...

Snap Creek Duplicator PHP Code Injection Vulnerability

Snap Creek Duplicator is a tool for migrating and backing up WordPress websites. A security vulnerability exists in Snap Creek Duplicator versions prior to 1.2.42. The vulnerability can be exploited by accessing the installer.php file and installer-backup.php file to inject PHP code into the...

UBUNTU-CVE-2018-12895

WordPress through 4.9.6 allows Author users to execute arbitrary code by leveraging directory traversal in the wp-admin/post.php thumb parameter, which is passed to the PHP unlink function and can delete the wp-config.php file. This is related to missing filename validation in the...

Worpress Service Finder Booking < 3.2 Plugin - Local File Disclosure Vulnerability

Exploit for php platform in category web applications Exploit Title: Worpress Plugin Service Finder Booking 3.2 - Local File Disclosure Google Dork: N/A Date: 09/01/2018 GMT+7 Exploit Author: telahdihapus Vendor Homepage: https://themeforest.net/user/aonetheme Software Link:...

Wordpress Plugin 'WP Mobile Edition' LFI Vulnerability

Wordpress Plugin 'WP Mobile Edition' is not filtering data so we can get the configration file in the path site.com/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php site.com/wp-content/themes/mTheme-Unus/css/css.php?files=../../../../wp-config.php CoderLeeT | Fallag...