230 matches found
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that 1 create or modify products or conduct cross-site scripting XSS attacks via the 2...
CVE-2013-5977: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in Cart66Product.php in the Cart66 Lite plugin before 1.5.1.15 for WordPress allows remote attackers to hijack the authentication of administrators for requests that 1 create or modify products or conduct cross-site scripting XSS attacks via the 2...
Cross site scripting
Cross-site scripting XSS vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php...
PT-2013-5105
Name of the Vulnerable Software and Affected Versions BackWPup plugin versions prior to 3.0.13 Description A cross-site scripting XSS issue allows remote attackers to inject arbitrary web script or HTML via the tab parameter to "wp-admin/admin.php". Recommendations For versions prior to 3.0.13,...
CVE-2013-4626: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the BackWPup plugin before 3.0.13 for WordPress allows remote attackers to inject arbitrary web script or HTML via the tab parameter to wp-admin/admin.php...
CVE-2013-3262: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the p parameter...
CVE-2013-5098: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in admin/admin.php in the Download Monitor plugin before 3.3.6.2 for WordPress allows remote attackers to inject arbitrary web script or HTML via the sort parameter, a different vulnerability than CVE-2013-3262...
CVE-2013-3261: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in wp-admin/admin.php in the GRAND FlAGallery plugin before 2.72 for WordPress allows remote attackers to inject arbitrary web script or HTML via the s parameter in a flag-manage-gallery action...
CVE-2013-3254
Cross-site scripting XSS vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppamanagecomments edit action...
CVE-2013-3254: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in wp-admin/admin.php in the WP Photo Album Plus plugin before 5.0.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the commentid parameter in a wppamanagecomments edit action...
WordPress GRAND FlAGallery Plugin <= 2.71 - XSS
Because of this vulnerability in wp-admin/admin.php, the attackers can inject arbitrary web script or HTML via the "s" parameter in a flag-manage-gallery action. Solution Update the plugin...
CVE-2012-6312
Cross-site scripting XSS vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php...
CVE-2012-6312: Improper Neutralization of Input During Web Page Generation
Cross-site scripting XSS vulnerability in the Video Lead Form plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the errMsg parameter in a video-lead-form action to wp-admin/admin.php...
Cross site request forgery (csrf)
Cross-site request forgery CSRF vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcmsodevelopername parameter in a save action to...
CVE-2012-5387: Cross-Site Request Forgery (CSRF)
Cross-site request forgery CSRF vulnerability in wlcms-plugin.php in the White Label CMS plugin before 1.5.1 for WordPress allows remote attackers to hijack the authentication of administrators for requests that modify the developer name via the wlcmsodevelopername parameter in a save action to...
CVE-2012-4994
The CVE-2012-4994 entry concerns a SQL injection in LimeSurvey’s admin/admin.php. Affected software is LimeSurvey prior to 1.91+ Build 120224, where remote authenticated users can inject SQL commands via the id parameter in a browse action. The vulnerability arises from improper sanitization of u...
CVE-2012-4994: Improper Neutralization of Special Elements used in an SQL Command
SQL injection vulnerability in admin/admin.php in LimeSurvey before 1.91+ Build 120224 allows remote authenticated users to execute arbitrary SQL commands via the id parameter in a browse action. NOTE: some of these details are obtained from third party information...
CVE-2012-4279: Improper Neutralization of Special Elements used in an SQL Command
Multiple SQL injection vulnerabilities in Free Realty 3.1-0.6 allow remote attackers to execute arbitrary SQL commands via the 1 view parameter to agentdisplay.php or 2 edit parameter to admin/admin.php...
Cross site scripting
Cross-site scripting XSS vulnerability in the Share and Follow plugin 1.80.3 for WordPress allows remote attackers to inject arbitrary web script or HTML via the CDN API Key cnd-key in a share-and-follow-menu page to wp-admin/admin.php...
CVE-2012-2912: Improper Neutralization of Input During Web Page Generation
Multiple cross-site scripting XSS vulnerabilities in the LeagueManager plugin 3.7 for WordPress allow remote attackers to inject arbitrary web script or HTML via the 1 group parameter in the show-league page or 2 season parameter in the team page to wp-admin/admin.php...