354 results · Feed
-
Unscored —CVE-2008-1930 Public exploit
The cookie authentication method in WordPress 2.5 relies on a hash of a concatenated string containing USERNAME and EXP…
-
Medium —CVE-2008-1502 EPSS 11%
Moodle vulnerable to Cross-site scripting
The _bad_protocol_once function in phpgwapi/inc/class.kses.inc.php in KSES, as used in eGroupWare before 1.4.003, Moodle before 1.8.5, and other products, allows remote attackers to bypass HTML filtering and conduct cross-site scripting (XSS) attacks via a st…
-
Unscored —
The XML-RPC implementation (xmlrpc.php) in WordPress before 2.3.3, when registration is enabled, allows remote attacker…
-
Unscored —
WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page par…
-
Unscored —CVE-2008-0193 Public exploit
Cross-site scripting (XSS) vulnerability in wp-db-backup.php in WordPress 2.0.11 and earlier, and possibly 2.1.x throug…
-
Unscored —CVE-2008-0192 Public exploit
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arb…
-
Unscored —
Directory traversal vulnerability in wp-db-backup.php in WordPress 2.0.3 and earlier allows remote attackers to read ar…
-
Unscored —
Multiple directory traversal vulnerabilities in WordPress 2.0.11 and earlier allow remote attackers to read arbitrary f…
-
Unscored —
WordPress 2.2.x and 2.3.x allows remote attackers to obtain sensitive information via an invalid p parameter in an rss2…
-
Unscored —CVE-2007-6318 Public exploit
SQL injection vulnerability in wp-includes/query.php in WordPress 2.3.1 and earlier allows remote attackers to execute …
-
Unscored —
Wordpress 1.5 through 2.3.1 uses cookie values based on the MD5 hash of a password MD5 hash, which allows attackers to …
-
Unscored —CVE-2007-5710 Public exploit
Cross-site scripting (XSS) vulnerability in wp-admin/edit-post-rows.php in WordPress 2.3 allows remote attackers to inj…
-
Unscored —
Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 allows remote attackers to inject arbitrar…
-
Unscored —CVE-2007-5105 Public exploit
Cross-site scripting (XSS) vulnerability in wp-register.php in WordPress 2.0 and 2.0.1 allows remote attackers to injec…
-
Unscored —
Multiple SQL injection vulnerabilities in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a allow remo…
-
Unscored —
wp-admin/admin-functions.php in Wordpress before 2.2.3 and Wordpress multi-user (MU) before 1.2.5a does not properly ve…
-
Unscored —
Cross-site scripting (XSS) vulnerability in index.php in the WordPress Classic 1.5 theme in WordPress before 2.1.3 allo…
-
Unscored —
SQL injection vulnerability in options.php in WordPress 2.2.1 allows remote authenticated administrators to execute arb…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.2.1 allow remote authenticated administrators to inj…
-
Unscored —
WordPress before 2.2.2 allows remote attackers to redirect visitors to other websites and potentially obtain sensitive …
-
Unscored —
Unrestricted file upload vulnerability in WordPress before 2.2.1 and WordPress MU before 1.2.3 allows remote authentica…
-
Unscored —
Unrestricted file upload vulnerability in (1) wp-app.php and (2) app.php in WordPress 2.2.1 and WordPress MU 1.2.3 allo…
-
Unscored —
Cross-site scripting (XSS) vulnerability in functions.php in the default theme in WordPress 2.2 allows remote authentic…
-
High —
PHPMailer Shell command injection
PHPMailer 1.7, when configured to use sendmail, allows remote attackers to execute arbitrary shell commands via shell metacharacters in the SendmailSend function in class.phpmailer.php.
-
Unscored —CVE-2007-3140 Public exploit
SQL injection vulnerability in xmlrpc.php in WordPress 2.2 allows remote authenticated users to execute arbitrary SQL c…
-
Unscored —CVE-2007-2821 Public exploit
SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbit…
-
Unscored —
Unspecified vulnerability in akismet.php in Matt Mullenweg Akismet before 2.0.2, a WordPress plugin, has unknown impact…
-
Unscored —
Cross-site scripting (XSS) vulnerability in sidebar.php in WordPress, when custom 404 pages that call get_sidebar are u…
-
Unscored —CVE-2007-1897 Public exploit
SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticate…
-
Unscored —
xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor ro…
-
Unscored —
Cross-site scripting (XSS) vulnerability in wp-includes/general-template.php in WordPress before 20070309 allows remote…
-
Unscored —
Cross-site scripting (XSS) vulnerability in an mt import in wp-admin/admin.php in WordPress 2.1.2 allows remote authent…
-
Unscored —CVE-2007-1622 Public exploit
Cross-site scripting (XSS) vulnerability in wp-admin/vars.php in WordPress before 2.0.10 RC2, and before 2.1.3 RC2 in t…
-
Unscored —
wp-login.php in WordPress allows remote attackers to redirect authenticated users to other websites and potentially obt…
-
Unscored —CVE-2007-1244 Public exploit
Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attacker…
-
Unscored —
Multiple cross-site scripting (XSS) vulnerabilities in wp-includes/functions.php in WordPress before 2.1.2-alpha allow …
-
Unscored —CVE-2007-1049 Public exploit
Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/f…
-
Unscored —CVE-2007-0540 Public exploit
WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service c…
-
Unscored —
The wp_remote_fopen function in WordPress before 2.1 allows remote attackers to cause a denial of service (bandwidth or…
-
Unscored —
WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain …