CVSS: 7.5EPSS: 0%CPEs: 22EXPL: 1CVE-2012-6625 – WP Forum Server < 1.7.4 - SQL Injection
https://notcve.org/view.php?id=CVE-2012-6625
SQL injection vulnerability in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the groupid parameter in an editgroup action. Vulnerabilidad de inyección de SQL en fs-admin/fs-admin.php en el plugin ForumPress WP Forum Server anterior a la versión 1.7.4 para WordPress permite a atacantes remotos ejecutar comandos de SQL arbitrarios a través del parámetro groupid en una acción editgroup. • https://www.exploit-db.com/exploits/17828 http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html http://wordpress.org/extend/plugins/forum-server/changelog http://www.securityfocus.com/bid/53530 https://plugins.trac.wordpress.org/changeset/532918 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 22EXPL: 2CVE-2012-6622 – WP Forum Server <= 1.7.3 - Authenticated (Admin+) Stored Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-6622
Multiple cross-site scripting (XSS) vulnerabilities in fs-admin/fs-admin.php in the ForumPress WP Forum Server plugin before 1.7.4 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action. Múltiples vulnerabilidades cross-site scripting (XSS) en fs-admin/fs-admin.php en el plugin ForumPress WP Forum Server anteriores a 1.7.4 para WordPress permite a atacantes remotos inyectar script web o HTML de forma arbitraria a través de (1) el parámetro groupip en una acción de editgroup o (2) el parámetro usergroup_id en una acción edit_usergroup. The WP Forum Server plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the (1) groupid parameter in an editgroup action or (2) usergroup_id parameter in an edit_usergroup action in versions up to, and including, 1.7.3 due to insufficient input sanitization and output escaping. This makes it possible for authenticated attackers with administrative capabilities to inject arbitrary web scripts in pages that will execute whenever a user accesses an injected page. This can also be exploited via CSRF by unauthenticated users due to missing nonce validation. • https://www.exploit-db.com/exploits/37195 http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html http://secunia.com/advisories/49155 http://wordpress.org/extend/plugins/forum-server/changelog http://www.securityfocus.com/bid/53530 https://plugins.trac.wordpress.org/changeset/532918 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.1EPSS: 0%CPEs: 22EXPL: 0CVE-2012-6623 – WP Forum Server < 1.7.5 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2012-6623
Cross-site scripting (XSS) vulnerability in fs-admin/wpf-add-forum.php in the ForumPress WP Forum Server plugin before 1.7.5 for WordPress allows remote attackers to inject arbitrary web script or HTML via the groupid parameter in an addforum action to wp-admin/admin.php. Vulnerabilidad cross-site scripting (XSS) en fs-admin/wpf-add-forum.php en el plugin ForumPress WP Forum Server anteriores a 1.7.5 para WordPress permite a atacantes remotos inyectar script web o HTML de forma arbitraria a través del parámetro groupid en una acción addforum en wp-admin/admin.php • http://packetstormsecurity.org/files/112703/WordPress-WP-Forum-Server-1.7.3-SQL-Injection-Cross-Site-Scripting.html http://secunia.com/advisories/49167 http://wordpress.org/extend/plugins/forum-server/changelog https://plugins.trac.wordpress.org/changeset/572188 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •