CVE-2015-0895: Cross-Site Request Forgery (CSRF)

Cross-site request forgery CSRF vulnerability in the All In One WP Security & Firewall plugin before 3.9.0 for WordPress allows remote attackers to hijack the authentication of administrators for requests that delete logs of 404 aka Not Found HTTP status codes...

CVE-2015-0894: Improper Neutralization of Special Elements used in an SQL Command

SQL injection vulnerability in the All In One WP Security & Firewall plugin before 3.8.8 for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors...

All In One WP Security & Firewall <= 3.8.9 - CSRF

According to the original advisory, "If a user views a malicious page while logged in, access logs 404 events maintained by the product may be deleted."...

CVE-2014-6242

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

Sql injection

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

CVE-2014-6242

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

CVE-2014-6242

All In One WP Security & Firewall (WordPress) has SQL injection vulnerabilities fixed in version 3.8.3 and earlier analyzed in CVE-2014-6242. HTB reports two SQLi flaws affecting all versions before 3.8.3, exploitable via the orderby and order parameters to wp-admin/admin.php (aiowpsec page). Exp...

PT-2014-7115

Name of the Vulnerable Software and Affected Versions All In One WP Security & Firewall plugin versions prior to 3.8.3 Description The issue allows remote authenticated users to execute arbitrary SQL commands via the orderby or order parameter in the aiowpsec page to wp-admin/admin.php. This can ...

CVE-2014-6242: Improper Neutralization of Special Elements used in an SQL Command

Multiple SQL injection vulnerabilities in the All In One WP Security & Firewall plugin before 3.8.3 for WordPress allow remote authenticated users to execute arbitrary SQL commands via the 1 orderby or 2 order parameter in the aiowpsec page to wp-admin/admin.php. NOTE: this can be leveraged using...

All In One WP Security plugin 3.8.2 - 2xSQL Injections

The All In One WP Security & Firewall WordPress plugin was affected by a 2xSQL Injections security vulnerability...

WordPress Plugin All In One WP Security 3.8.2 - SQL Injection

WordPress Plugin All In One WP Security 3.8.2 - SQL Injection Advisory ID: HTB23231 Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Versions: 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication: September 3, 2014 without...

WordPress All In One WP Security Plugin 3.8.2 SQL Injection Vulnerability

WordPress All In One WP Security plugin version 3.8.2 suffers from multiple remote SQL injection vulnerabilities. Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Versions: 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication...

WordPress Plugin All In One WP Security 3.8.2 - SQL Injection

Advisory ID: HTB23231 Product: All In One WP Security WordPress plugin Vendor: Tips and Tricks HQ, Peter, Ruhul, Ivy Vulnerable Versions: 3.8.2 and probably prior Tested Version: 3.8.2 Advisory Publication: September 3, 2014 without technical details Vendor Notification: September 3, 2014 Vendor...

Two SQL Injections in All In One WP Security WordPress plugin

High-Tech Bridge Security Research Lab discovered two SQL injection vulnerabilities in All In One WP Security WordPress plugin, which can be exploited to perform SQL Injection attacks. Both vulnerabilities require administrative privileges, however can be also exploited by non-authenticated...

Acunetix WP Security 4.0.3 - /wp-admin/admin.php wps-database Page Backup Generation CSRF Weakness

The Acunetix WP Security WordPress plugin was affected by a /wp-admin/admin.php wps-database Page Backup Generation CSRF Weakness security vulnerability...

Wordpress Plugin Better WP Security - Stored XSS

No description provided by source. ======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren [email protected] Vendor: Bit51 Vendor Reference: Systems Affected: Bit51 Better...

Better WP Security Plugin for WordPress Multiple XSS

The WordPress Better WP Security Plugin installed on the remote host is affected by multiple cross-site scripting XSS vulnerabilities : - The application fails to properly sanitize user-supplied input to the HTTPUSERAGENT header. CVE-2012-4263 - The application fails to properly sanitize...

WordPress Better WP Security 3.6.3 XSS / Disclosure

Exploit Title: Wordpress Plugin - Better WP Security multiple vulnerability Date: 2014 11 Fabruary Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit goes for: http://y-shahinzadeh.ir & ha.cker.ir Vendor Homepage: https://wordpress.org/plugins/better-wp-security/ Tested on: Lin...

WordPress Better WP Security 3.6.3 XSS / Disclosure Vulnerabilities

WordPress Better WP Security plugin version 3.6.3 suffers from information disclosure and cross site scripting vulnerabilities. Exploit Title: Wordpress Plugin - Better WP Security multiple vulnerability Date: 2014 11 Fabruary Exploit Author: Yashar shahinzadeh Special thanks to Mormoroth Credit...

NGS00500 Technical Advisory: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE

======= Summary ======= Name: Bit51 Better WP Security Plugin - Unauthenticated Stored XSS to RCE Release Date: 30 July 2013 Reference: NGS00500 Discoverer: Richard Warren [email protected] Vendor: Bit51 Vendor Reference: Systems Affected: Bit51 Better WP Security Plugin Version...