354 results · Feed
-
Unscored —CVE-2012-0782 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in wp-admin/setup-config.php in the installation component in WordP…
-
Unscored —
Cross-site scripting (XSS) vulnerability in wp-comments-post.php in WordPress 3.3.x before 3.3.1, when Internet Explore…
-
Unscored —
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 allows remote attackers to determine usernames of non-authors via cano…
-
Unscored —
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 does not prevent rendering for (1) admin or (2) login pages inside a f…
-
Unscored —
The file upload functionality in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2, when running "on hosts with dangerou…
-
Unscored —
WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 treats unattached attachments as published, which might allow remote a…
-
Unscored —
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors rel…
-
Unscored —
wp-includes/taxonomy.php in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors rela…
-
Unscored —
Unspecified vulnerability in WordPress 3.1 before 3.1.3 and 3.2 before Beta 2 has unknown impact and attack vectors rel…
-
Unscored —
wp-admin/async-upload.php in the media uploader in WordPress before 3.0.5 allows remote authenticated users to read (1)…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to injec…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in KSES, as used in WordPress before 3.0.4, allow remote attackers …
-
Unscored —
SQL injection vulnerability in the do_trackbacks function in wp-includes/comment.php in WordPress before 3.0.2 allows r…
-
Medium —
Moodle Cross-site Scripting vulnerability in the KSES text cleaning filter
The KSES text cleaning filter in lib/weblib.php in Moodle before 1.8.13 and 1.9.x before 1.9.9 does not properly handle vbscript URIs, which allows remote authenticated users to conduct cross-site scripting (XSS) attacks via HTML input.
-
Unscored —
WordPress 2.9 before 2.9.2 allows remote authenticated users to read trash posts from other authors via a direct reques…
-
Unscored —
Cross-site scripting (XSS) vulnerability in wp-admin/press-this.php in WordPress before 2.8.6 allows remote authenticat…
-
Unscored —CVE-2009-3890 Public exploit
Unrestricted file upload vulnerability in the wp_check_filetype function in wp-includes/functions.php in WordPress befo…
-
Unscored —
Algorithmic complexity vulnerability in wp-trackback.php in WordPress before 2.8.5 allows remote attackers to cause a d…
-
Unscored —
Unspecified vulnerability in Prototype JavaScript framework (prototypejs) before 1.6.0.2 allows attackers to make "cros…
-
Unscored —
Wordpress before 2.8.3 allows remote attackers to gain privileges via a direct request to (1) admin-footer.php, (2) edi…
-
Unscored —CVE-2009-2851 Public exploit
Cross-site scripting (XSS) vulnerability in the administrator interface in WordPress before 2.8.2 allows remote attacke…
-
Unscored —
Wordpress before 2.8.3 does not check capabilities for certain actions, which allows remote attackers to make unauthori…
-
Unscored —
wp-login.php in WordPress 2.8.3 and earlier allows remote attackers to force a password reset for the first user in the…
-
Unscored —
WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sens…
-
Unscored —
The forgotten mail interface in WordPress and WordPress MU before 2.8.1 exhibits different behavior for a password requ…
-
Unscored —CVE-2009-2334 Public exploit
wp-admin/admin.php in WordPress and WordPress MU before 2.8.1 does not require administrative authentication to access …
-
Unscored —
WordPress and WordPress MU before 2.8.1 allow remote attackers to obtain sensitive information via a direct request to …
-
Unscored —
WordPress and WordPress MU before 2.8.1 exhibit different behavior for a failed login attempt depending on whether the …
-
Unscored —
Open redirect vulnerability in wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to redirect u…
-
Unscored —
wp-admin/upgrade.php in WordPress, probably 2.6.x, allows remote attackers to upgrade the application, and possibly cau…
-
Unscored —
wp-admin/options.php in WordPress MU before 1.3.2, and WordPress 2.3.2 and earlier, does not properly validate requests…
-
Unscored —
Cross-site scripting (XSS) vulnerability in the self_link function in in the RSS Feed Generator (wp-includes/feed.php) …
-
Unscored —
WordPress 2.6.3 relies on the REQUEST superglobal array in certain dangerous situations, which makes it easier for remo…
-
Unscored —
The _httpsrequest function (Snoopy/Snoopy.class.php) in Snoopy 1.2.3 and earlier, as used in (1) ampache, (2) libphp-sn…
-
Unscored —CVE-2008-4769 Public exploit
Directory traversal vulnerability in the get_category_template function in wp-includes/theme.php in WordPress 2.3.3 and…
-
Unscored —
WordPress before 2.6.2 does not properly handle MySQL warnings about insertion of username strings that exceed the maxi…
-
Unscored —
The (1) get_edit_post_link and (2) get_edit_comment_link functions in wp-includes/link-template.php in WordPress before…
-
Unscored —
Unrestricted file upload vulnerability in WordPress 2.5.1 and earlier might allow remote authenticated administrators t…
-
Unscored —
wp-includes/vars.php in Wordpress before 2.2.3 does not properly extract the current path from the PATH_INFO ($PHP_SELF…
-
Unscored —
Cross-site scripting (XSS) vulnerability in WordPress 2.5 allows remote attackers to inject arbitrary web script or HTM…