CVSS: 9.8EPSS: 96%CPEs: 1EXPL: 2CVE-2015-6522 – WP Symposium <= 15.8 - Unauthenticated SQL Injection
https://notcve.org/view.php?id=CVE-2015-6522
SQL injection vulnerability in the WP Symposium plugin before 15.8 for WordPress allows remote attackers to execute arbitrary SQL commands via the size parameter to get_album_item.php. Vulnerabilidad de inyección SQL en el plugin WP Symposium en versiones anteriores a 15.8 para WordPress, permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro size a get_album_item.php. • https://www.exploit-db.com/exploits/37824 https://wpvulndb.com/vulnerabilities/8140 - • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 2CVE-2015-3325 – WP Symposium < 15.4 - SQL Injection
https://notcve.org/view.php?id=CVE-2015-3325
SQL injection vulnerability in forum.php in the WP Symposium plugin before 15.4 for WordPress allows remote attackers to execute arbitrary SQL commands via the show parameter in the QUERY_STRING to the default URI. Vulnerabilidad de inyección SQL en forum.php en el plugin WP Symposium anterior a 15.4 para WordPress permite a atacantes remotos ejecutar comandos SQL arbitrarios a través del parámetro show en QUERY_STRING en la URI por defecto. WordPress WP Symposium plugin version 15.1 suffers from a remote SQL injection vulnerability. • https://www.exploit-db.com/exploits/37080 http://packetstormsecurity.com/files/131801/WordPress-WP-Symposium-15.1-SQL-Injection.html http://www.securityfocus.com/bid/74237 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 91%CPEs: 1EXPL: 3CVE-2014-10021 – WP Symposium <= 14.11 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2014-10021
Unrestricted file upload vulnerability in UploadHandler.php in the WP Symposium plugin 14.11 for WordPress allows remote attackers to execute arbitrary code by uploading a file with an executable extension, then accessing it via a direct request to the file in server/php/. Vulnerabilidad de la subida de ficheros sin restricciones en UploadHandler.php en el plugin WP Symposium 14.11 para WordPress permite a atacantes remotos ejecutar código arbitrario mediante la subida de un fichero con una extensión ejecutable, posteriormente accediéndolo a través de una solicitud directa al fichero en server/php/. The WP Symposium plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the UploadHandler.php file in versions up to, and including, 14.11. This makes it possible for attackers to upload arbitrary files on the affected sites server which may make remote code execution possible when the file is accessed from the server/php/directory. • https://www.exploit-db.com/exploits/35778 https://www.exploit-db.com/exploits/35543 http://www.exploit-db.com/exploits/35543 http://www.securityfocus.com/bid/71686 • CWE-434: Unrestricted Upload of File with Dangerous Type •