Vulnerabilities
Fancy Gallery 1.5.12 Reflected XSS
$_GET['delete'] is not escaped.
20-11-2014
1 MIN READ
Vulnerabilities
XCloner Backup and Restore 3.1.1 Backup Download
json_return() function doesn't check admin privileges.
19-11-2014
1 MIN READ
Vulnerabilities
Paid Memberships Pro 1.7.14.2 Path Traversal
is_admin() function is used to check priveleges but because this code is run in context of wp-admin/admin-ajax.php this function always evalute to true.
17-11-2014
1 MIN READ
Vulnerabilities
Watu 2.4.9 XSS
Datas from Open End questions are not escaped properly.
16-11-2014
1 MIN READ
Vulnerabilities
DukaPress 2.5.2 Path Traversal
REQUEST['src'] is passed directly into file_get_contents function.
13-11-2014
1 MIN READ
Vulnerabilities
Google Doc Embedder 2.5.14 SQL Injection
$_GET['gpid'] is not escaped.
11-11-2014
1 MIN READ
Vulnerabilities
Contact Form Maker 1.7.18 XSS
_form_makercfm() is accessible for every registered user.
09-11-2014
1 MIN READ
Vulnerabilities
Link Library 5.8.10.6 Reflected XSS
$_GET['searchll'] is not escaped.
08-11-2014
1 MIN READ
From 0 to pentesting hero
Open redirection
We are used to the fact that websites contain links to another web services. But, can automatic redirection to external domain be harmful?
09-04-2019
3 MIN READ