CVSS: 9.8EPSS: 2%CPEs: 3EXPL: 3CVE-2009-2396 – DM Albums <= 1.9.2 - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2009-2396
PHP remote file inclusion vulnerability in template/album.php in DM Albums 1.9.2, as used standalone or as a WordPress plugin, allows remote attackers to execute arbitrary PHP code via a URL in the SECURITY_FILE parameter. Vulnerabilidad de inclusión de archivo remoto PHP en template/album.php en DM Albums v1.9.2, utilizado independiente o como un plugin de WordPress, permite a atacantes remotos ejecutar código PHP arbitrario a través de una URL en el parámetro SECURITY_FILE. • https://www.exploit-db.com/exploits/9043 http://secunia.com/advisories/35619 http://www.exploit-db.com/exploits/9043 http://www.securityfocus.com/bid/35521 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 10.0EPSS: 0%CPEs: 66EXPL: 0CVE-2009-2144 – FireStats <1.6.2 - SQL Injection
https://notcve.org/view.php?id=CVE-2009-2144
SQL injection vulnerability in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary SQL commands via unspecified vectors. Vulnerabilidad de inyección SQL en el plugin FireStats en sus versiones anteriores a 1.6.2-stable de WordPress permite a usuarios remotos ejecutar comandos SQL de su elección a través de vectores de ataque desconocidos. • http://firestats.cc/wiki/ChangeLog#a1.6.2-stable13062009 http://secunia.com/advisories/35400 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 2EXPL: 2CVE-2009-2122 – Photoracer Plugin <= 1.0 - SQL Injection
https://notcve.org/view.php?id=CVE-2009-2122
SQL injection vulnerability in viewimg.php in the Paolo Palmonari Photoracer plugin 1.0 for WordPress allows remote attackers to execute arbitrary SQL commands via the id parameter. Vulnerabilidad de inyección SQL en viewimg.php en la extensión (plugin) Paolo Palmonari Photoracer v1.0 para WordPress permite a atacantes remotos ejecutar comandos SQL de su elección mediante el parámetro "id". • https://www.exploit-db.com/exploits/8961 http://secunia.com/advisories/35450 http://www.securityfocus.com/bid/35382 https://exchange.xforce.ibmcloud.com/vulnerabilities/51152 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 9.8EPSS: 0%CPEs: 67EXPL: 1CVE-2009-2143 – FireStats < 1.6.2 - Remote File Inclusion
https://notcve.org/view.php?id=CVE-2009-2143
PHP remote file inclusion vulnerability in firestats-wordpress.php in the FireStats plugin before 1.6.2-stable for WordPress allows remote attackers to execute arbitrary PHP code via a URL in the fs_javascript parameter. Vulnerabilidad de inclusión de fichero remoto PHP en firestats-wordpress.ph del plugin FireStats de WordPress en sus versiones anteriores a 1.6.2-stable. Permite a usuarios remotos ejecutar código PHP de su elección a través de una URL en el parámetro fs_javscript. • http://firestats.cc/wiki/ChangeLog#a1.6.2-stable13062009 http://secunia.com/advisories/35400 https://www.exploit-db.com/exploits/8945 • CWE-94: Improper Control of Generation of Code ('Code Injection') CWE-98: Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') •
CVSS: 5.3EPSS: 0%CPEs: 1EXPL: 0CVE-2009-2431 – WordPress Core < 2.8 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2009-2431
WordPress 2.7.1 places the username of a post's author in an HTML comment, which allows remote attackers to obtain sensitive information by reading the HTML source. WordPress v2.7.1 coloca el nombre de usuario del autor de un post en un comentario HTML, lo cual permite a atacantes remotos obtener información sensible mediante la lectura del código fuente HTML. • http://corelabs.coresecurity.com/index.php?action=view&type=advisory&name=WordPress_Privileges_Unchecked http://securitytracker.com/id?1022528 http://www.osvdb.org/55716 http://www.securityfocus.com/archive/1/504795/100/0/threaded http://www.vupen.com/english/advisories/2009/1833 https://exchange.xforce.ibmcloud.com/vulnerabilities/51733 • CWE-20: Improper Input Validation CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •