CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 1CVE-2012-6625 – WP Forum Server < 1.7.4 - SQL Injection
https://notcve.org/view.php?id=CVE-2012-6625
SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the groupid parameter in an editgroup action. Vulnerabilidad de inyección de SQL en fs-admin/fs-admin.php en el plugin ForumPress WP Forum Server anterior a la versión 1.7.4 para WordPress permite a atacantes remotos ejecutar comandos de SQL arbitrarios a través del parámetro groupid en una acción editgroup. • https://www.exploit-db.com/exploits/17828 http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html http://wordpress.org/extend/plugins/forum-server/changelog http://www.securityfocus.com/bid/53530 https://plugins.trac.wordpress.org/changeset/532918 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 22EXPL: 2CVE-2012-6622 – WP Forum Server <= 1.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-6622
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action. Múltiples vulnerabilidades cross-site scripting (XSS) en fs-admin/fs-admin.php en el plugin ForumPress WP Forum Server anteriores a 1.7.4 para WordPress permite a atacantes remotos inyectar script web o HTML de forma arbitraria a través de (1) el parámetro groupip en una acción de editgroup o (2) el parámetro usergroup_id en una acción edit_usergroup. The WP Forum Server plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action in versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative capabilities to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This can also be exploited via CSRF by unauthenticated users due to missing nonce validation. • https://www.exploit-db.com/exploits/37195 http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html http://secunia.com/advisories/49155 http://wordpress.org/extend/plugins/forum-server/changelog http://www.securityfocus.com/bid/53530 https://plugins.trac.wordpress.org/changeset/532918 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 22EXPL: 0CVE-2012-6623 – WP Forum Server < 1.7.5 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-6623
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php. Vulnerabilidad cross-site scripting (XSS) en fs-admin/wpf-add-forum.php en el plugin ForumPress WP Forum Server anteriores a 1.7.5 para WordPress permite a atacantes remotos inyectar script web o HTML de forma arbitraria a través del parámetro groupid en una acción addforum en wp-admin/admin.php • http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html http://secunia.com/advisories/49167 http://wordpress.org/extend/plugins/forum-server/changelog https://plugins.trac.wordpress.org/changeset/572188 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 0%CPEs: 3EXPL: 3CVE-2011-1047 – WP Forum Server <= 1.6.5 - SQL Injection
https://notcve.org/view.php?id=CVE-2011-1047
Multiple SQL injection vulnerabilities in VastHTML Forum Server (aka ForumPress) plugin 1.6.1 and 1.6.5 for WordPress allow remote attackers to execute arbitrary SQL commands via the (1) search_max parameter in a search action to index.php, which is not properly handled by wpf.class.php, (2) id parameter in an editpost action to index.php, which is not properly handled by wpf-post.php, or (3) topic parameter to feed.php. Múltiples vulnerabilidades de inyección SQL en el plugin Forum Server (también se conoce como ForumPress) versiones 1.6.1 y 1.6.5 de VastHTML para WordPress, permiten a los atacantes remotos ejecutar comandos SQL arbitrarios por medio del (1) parámetro search_max en una acción search en el archivo index.php, que no es manejado apropiadamente por el archivo wpf.class.php, (2) parámetro id en una acción editpost en archivo index.php, que no es manejado apropiadamente por archivo wpf-post.php, o (3) topic a feed.php. • https://www.exploit-db.com/exploits/16235 http://osvdb.org/70993 http://osvdb.org/70994 http://secunia.com/advisories/43306 http://securityreason.com/securityalert/8099 http://www.htbridge.ch/advisory/sql_injection_in_wp_forum_server_wordpress_plugin.html http://www.htbridge.ch/advisory/sql_injection_in_wp_forum_server_wordpress_plugin_1.html http://www.htbridge.ch/advisory/sql_injection_in_wp_forum_server_wordpress_plugin_2.html http://www.securityfocus.com/archive/1/516400/100/ • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •