CVSS: 9.8EPSS: 96%CPEs: 1EXPL: 2CVE-2015-6522 – WP Symposium <= 15.8 - Unauthenticated SQL Injection
https://notcve.org/view.php?id=CVE-2015-6522
SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php. Vulnerabilidad de inyección SQL en el plugin WP Symposium en versiones anteriores a 15.8 para WordPress, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro size a get_album_item.php. • https://www.exploit-db.com/exploits/37824 https://wpvulndb.com/vulnerabilities/8140 - • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2015-3325 – WP Symposium < 15.4 - SQL Injection
https://notcve.org/view.php?id=CVE-2015-3325
SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERY_STRING to the default URI. Vulnerabilidad de inyección SQL en forum.php en el plugin WP Symposium anterior a 15.4 para WordPress permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro show en QUERY_STRING en la URI por defecto. WordPress WP Symposium plugin version 15.1 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/37080 http://packetstormsecurity.com/files/131801/WordPress-WP-Symposium-15.1-SQL-Injection.html http://www.securityfocus.com/bid/74237 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 91%CPEs: 1EXPL: 3CVE-2014-10021 – WP Symposium <= 14.11 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2014-10021
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/. Vulnerabilidad de la subida de ficheros sin restricciones en UploadHandler.php en el plugin WP Symposium 14.11 para WordPress permite a atacantes remotos ejecutar código arbitrario mediante la subida de un fichero con una extensión ejecutable, posteriormente accediéndolo a través de una solicitud directa al fichero en server/php/. The WP Symposium plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the UploadHandler.php file in versions up to, and including, 14.11. This makes it possible for attackers to upload arbitrary files on the affected sites server which may make remote code execution possible when the file is accessed from the server/php/directory. • https://www.exploit-db.com/exploits/35778 https://www.exploit-db.com/exploits/35543 http://www.exploit-db.com/exploits/35543 http://www.securityfocus.com/bid/71686 • CWE-434: Unrestricted Upload of File with Dangerous Type •
CVSS: 9.9EPSS: 0%CPEs: 1EXPL: 3CVE-2014-8810 – WP Symposium < 14.11 - Authenticated SQL Injection
https://notcve.org/view.php?id=CVE-2014-8810
SQL injection vulnerability in ajax/mail_functions.php in the WP Symposium plugin before 14.11 for WordPress allows remote authenticated users to execute arbitrary SQL commands via the tray parameter in a getMailMessage action. Vulnerabilidad de inyección SQL en ajax/mail_functions.php del plugin WP Symposium anterior 14.11 de WordPress permite a usuarios remotos autenticados ejecutar comandos arbitrarios de SQL a través del parámetro en la acción getMailMessage • https://www.exploit-db.com/exploits/35505 http://secunia.com/advisories/62643 http://security.szurek.pl/wp-symposium-1410-multiple-xss-and-sql-injection.html http://www.exploit-db.com/exploits/35505 http://www.wpsymposium.com/2014/11/release-information-for-v14-11 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2014-8809 – WP Symposium <= 14.10 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-8809
Multiple cross-site scripting (XSS) vulnerabilities in the WP Symposium plugin before 14.11 for WordPress allow remote attackers to inject arbitrary web script or HTML via the (1) text parameter in an addComment action to ajax/profile_functions.php, (2) compose_text parameter in a sendMail action to ajax/mail_functions.php, (3) comment parameter in an add_comment action to ajax/lounge_functions.php, or (4) name parameter in a create_album action to ajax/gallery_functions.php. Vulnerabilidades múltiples XSS en el plugin WP Symposium anterior a 14.11 de WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de (1) parámetro texto en la acción addComment a ajax/profile_functions.php, (2) parámetro compose_text en la acción sendMail a ajax/mail_functions.php, (3) parámetro comentario en la acción add_comment a ajax/lounge_functions.php, o (4) parámetro nombre en la acción create_album a ajax/gallery_functions.php. • http://security.szurek.pl/wp-symposium-1410-multiple-xss-and-sql-injection.html http://www.wpsymposium.com/release-information-for-v14-11 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •