CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 0CVE-2015-4338 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.2 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2015-4338
Static code injection vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary PHP code into the language files via a Translation LM_FRONT_* field for a language, as demonstrated by language/italian.php. Vulnerabilidad de inyección de código estático en el plugin XCloner 3.1.2 para WordPress permite a usuarios remotos autenticados inyectar código PHP arbitrario en los ficheros de idiomas a través de un campo Translation LM_FRONT_* para un idioma, tal y como fue demostrado por language/italian.php. WordPress XCloner plugin version 3.1.2 suffers from command execution and cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/132107/WordPress-XCloner-3.1.2-XSS-Command-Execution.html http://www.securityfocus.com/bid/74943 http://www.vapid.dhs.org/advisory.php?v=121 • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 2CVE-2015-4337 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.2 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2015-4337
Cross-site scripting (XSS) vulnerability in the XCloner plugin 3.1.2 for WordPress allows remote authenticated users to inject arbitrary web script or HTML via the excl_manual parameter in the xcloner_show page to wpadmin/plugins.php. Vulnerabilidad de XSS en el plugin XCloner 3.1.2 para WordPress permite a usuarios remotos autenticados inyectar secuencias de comandos web arbitrarios o HTML a través del parámetro excl_manual en la página xcloner_show en wpadmin/plugins.php. WordPress XCloner plugin version 3.1.2 suffers from command execution and cross site scripting vulnerabilities. • http://packetstormsecurity.com/files/132107/WordPress-XCloner-3.1.2-XSS-Command-Execution.html http://www.securityfocus.com/bid/74943 http://www.vapid.dhs.org/advisory.php?v=121 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 3CVE-2014-8607 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Sensitive Information Disclosure
https://notcve.org/view.php?id=CVE-2014-8607
The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! provides the MySQL username and password on the command line, which allows local users to obtain sensitive information via the ps command. El plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! proporciona el nombre de usuario y la contraseña de MySQL en la línea de comando, lo que permite a usuarios locales obtener información sensible a través de el comando ps. The XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! • https://www.exploit-db.com/exploits/35212 http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 http://www.vapid.dhs.org/advisory.php?v=110 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •
CVSS: 4.9EPSS: 0%CPEs: 2EXPL: 3CVE-2014-8606 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Directory Traversal
https://notcve.org/view.php?id=CVE-2014-8606
Directory traversal vulnerability in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to read arbitrary files via a .. (dot dot) in the file parameter in a json_return action in the xcloner_show page to wp-admin/admin-ajax.php. Vulnerabilidad de salto de directorio en el plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! permite a administradores remotos leer ficheros arbitrarios a través de un .. • https://www.exploit-db.com/exploits/35212 http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 http://www.vapid.dhs.org/advisory.php?v=110 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 7.2EPSS: 0%CPEs: 2EXPL: 3CVE-2014-8603 – Backup, Restore and Migrate WordPress Sites With the XCloner Plugin <= 3.1.1 - Remote Code Execution
https://notcve.org/view.php?id=CVE-2014-8603
cloner.functions.php in the XCloner plugin 3.1.1 for WordPress and 3.5.1 for Joomla! allows remote administrators to execute arbitrary code via shell metacharacters in the (1) file name when creating a backup or vectors related to the (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG['tarcompress'], (5) $_CONFIG['filename'], (6) $_CONFIG['exfile_tar'], (7) $_CONFIG[sqldump], (8) $_CONFIG['mysql_host'], (9) $_CONFIG['mysql_pass'], (10) $_CONFIG['mysql_user'], (11) $database_name, or (12) $sqlfile variable. cloner.functions.php en el plugin XCloner 3.1.1 para WordPress y 3.5.1 para Joomla! permite a administradores remotos ejecutar código arbitrario a través de metacaracteres de shell en (1) el nombre de fichero cuando crea una copia de seguridad o vectores relacionados con la variable (2) $_CONFIG[tarpath], (3) $exclude, (4) $_CONFIG['tarcompress'], (5) $_CONFIG['filename'], (6) $_CONFIG['exfile_tar'], (7) $_CONFIG[sqldump], (8) $_CONFIG['mysql_host'], (9) $_CONFIG['mysql_pass'], (10) $_CONFIG['mysql_user'], (11) $database_name o (12) $sqlfile. XCloner plugin version 3.1.1 for WordPress and 3.5.1 for Joomla! suffers from arbitrary command execution, MySQL password disclosure, database backups exposed, unauthenticated remote access, and various other vulnerabilities. • https://www.exploit-db.com/exploits/35212 http://www.vapid.dhs.org/advisories/wordpress/plugins/Xcloner-v3.1.1 http://www.vapid.dhs.org/advisory.php?v=110 • CWE-20: Improper Input Validation CWE-94: Improper Control of Generation of Code ('Code Injection') •