CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2014-10012 – WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds < 3.0 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2014-10012
Cross-site scripting (XSS) vulnerability in the Another WordPress Classifieds Plugin plugin for WordPress allows remote attackers to inject arbitrary web script or HTML via the query string to the default URI. Vulnerabilidad de XSS en el plugin Another WordPress Classifieds Plugin para WordPress permite a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a través de la cadena de consulta en la URI por defecto. • http://packetstormsecurity.com/files/129035/Another-WordPress-Classifieds-Cross-Site-Scripting-SQL-Injection.html https://exchange.xforce.ibmcloud.com/vulnerabilities/98588 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 0CVE-2012-4874 – WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds < 2.0 - Arbitrary File Upload
https://notcve.org/view.php?id=CVE-2012-4874
Unspecified vulnerability in the Another WordPress Classifieds Plugin before 2.0 for WordPress has unknown impact and attack vectors related to "image uploads." Vulnerabilidad no especificada en el plugin Another WordPress Classifieds anterior a v2.0 tiene un impacto desconocido y vectores de ataque similares a "archivos de imagen." The WordPress Classifieds Plugin – Ad Directory & Listings by AWP Classifieds plugin for WordPress is vulnerable to arbitrary file uploads due to missing file type validation in the admin_handleimagesupload function in versions up to, and including, 1.8.9.4. This makes it possible for authenticated attackers, with administrator-level permissions and above, to upload arbitrary files on the affected sites server which may make remote code execution possible. • http://osvdb.org/80881 http://secunia.com/advisories/47335 http://wordpress.org/extend/plugins/another-wordpress-classifieds-plugin/changelog http://www.securityfocus.com/bid/52861 • CWE-434: Unrestricted Upload of File with Dangerous Type •