118 matches found
CVE-2012-5913: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in wp-integrator.php in the WordPress Integrator module 1.32 for WordPress allows remote attackers to inject arbitrary web script or HTML via the redirectto parameter to wp-login.php...
PT-2012-4240
Name of the Vulnerable Software and Affected Versions Login With Ajax plugin versions prior to 3.0.4.1 Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML. This is achieved via the callback parameter in a lostpassword action to wp-login.php...
WordPress Register Plus Plugin Multiple Vulnerabilities
WordPress Register Plus Plugin is prone to multiple vulnerabilities. SPDX-FileCopyrightText: 2010 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only CPE =...
CVE-2010-4402
The CVE refers to WordPress Register Plus Plugin before or at version 3.5.1, where wp-login.php exposes multiple XSS flaws. The root cause is unsanitized/reflective input in the register action, enabling remote attackers to inject arbitrary script or HTML via the 9 parameters: firstname, lastname...
WordPress Register Plus Plugin <= 3.5.1 - Multiple XSS
Because of these vulnerabilities in wp-login.php, the attackers can inject arbitrary web script or HTML via the "website", "aim", "yahoo", "jabber", "firstname", "lastname", "about", "pass1", and "pass2" parameters in a register action. Solution Update the plugin...
PT-2010-5478
Name of the Vulnerable Software and Affected Versions Register Plus plugin versions 3.5.1 and earlier Description The issue allows remote attackers to inject arbitrary web script or HTML via several parameters in a register action, including firstname, lastname, website, aim, yahoo, jabber, about...
CVE-2010-4402: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in wp-login.php in the Register Plus plugin 3.5.1 and earlier for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 firstname, 2 lastname, 3 website, 4 aim, 5 yahoo, 6 jabber, 7 about, 8 pass1, and 9 pass2 parameter...
WordPress 1.2 wp-login.php响应拆分攻击漏洞
No description provided by source...
WordPress-MU < 2.8.4 'wp-login.php' Security Bypass Vulnerability
WordPres-MU is prone to a security bypass vulnerability. Copyright C 2009 Greenbone Networks GmbH Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-or-later This program is free software; you...
CVE-2009-2762
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key array variable in a resetpass aka rp action, which bypasses a check that assumes that $key is not an array...
CVE-2009-2762
CVE-2009-2762 affects WordPress ≤ 2.8.3. The vulnerability allows remote attackers to trigger a password reset for the first user (potentially admin) by supplying a key[] array to the resetpass (rp) action, bypassing the check that key is not an array. This is a network‑level exploit with a CVSSv...
CVE-2009-2762: Undefined Security Weakness
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the database, possibly the administrator, via a key array variable in a resetpass aka rp action, which bypasses a check that assumes that $key is not an array...
WordPress < 2.8.4 'wp-login.php' 'key' Parameter Remote Administrator Password Reset (uncredentialed check)
According to its version number, the version of WordPress running on the remote server has a flaw in the password reset mechanism. Validation of the secret user activation key can be bypassed by providing an array instead of a string. This allows anyone to reset the password of the first user in...
Wordpress 2.7.0 admin remote code execution vulnerability-vulnerability warning-the black bar safety net
by Ryatpuretot mail: puretot at gmail dot com team: http://www.80vul.com date: 2008-12-18 Analysis: This vulnerability out in the background: wp-admin/post.php if currentusercan'editpost', $postID if $last = wpcheckpostlock $post-ID $lastuser = getuserdata $last ; $lastusername = $lastuser ?...
WordPress MU 1.3.2 - active_plugins option Code Execution
WordPress MU 1.3.2 - activeplugins option Code Execution Website : http://www.buayacorp.com/ Advisory: http://www.buayacorp.com/files/wordpress/wordpress-mu-options-overwrite.html This exploit uses activeplugins option to execute arbitrary PHP / includeonce './class-snoopy.php'; // Fix Snoopy cla...
Information disclosure
wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive information via the redirectto parameter...
CVE-2007-1599
wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive information via the redirectto parameter...
CVE-2007-1599
wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obtain sensitive information via the redirectto parameter...
