CVSS: 9.8EPSS: 5%CPEs: 1EXPL: 3CVE-2007-2821 – WordPress Core 2.1.3 - 'admin-ajax.php' SQL Injection Blind Fishing
https://notcve.org/view.php?id=CVE-2007-2821
22 May 2007 — SQL injection vulnerability in wp-admin/admin-ajax.php in WordPress before 2.2 allows remote attackers to execute arbitrary SQL commands via the cookie parameter. Vulnerabilidad de inyección SQL en wp-admin/admin-ajax.php en WordPress anterior a 2.2 permite a atacantes remotos ejecutar comandos SQL de su elección a través del parámetro cookie. • https://www.exploit-db.com/exploits/3960 •
CVSS: 7.2EPSS: 2%CPEs: 1EXPL: 6CVE-2008-0192 – WordPress Core <= 2.0.9 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2008-0192
03 Apr 2007 — Multiple cross-site scripting (XSS) vulnerabilities in WordPress 2.0.9 and earlier allow remote attackers to inject arbitrary web script or HTML via the popuptitle parameter to (1) wp-admin/post.php or (2) wp-admin/page-new.php. Múltiples vulnerabilidades de secuencias de comandos en sitios cruzados (XSS) en WordPress 2.0.9 y anteriores permiten a atacantes remotos inyectar secuencias de comandos web o HTML de su elección a través del parámetro popuptitle de (1) wp-admin/post.php o (2) wp-admin/page-new.php... • https://www.exploit-db.com/exploits/30978 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 8.1EPSS: 0%CPEs: 1EXPL: 0CVE-2007-1893 – WordPress Core < 2.1.3 - Authorization Bypass
https://notcve.org/view.php?id=CVE-2007-1893
03 Apr 2007 — xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users with the contributor role to bypass intended access restrictions and invoke the publish_posts functionality, which can be used to "publish a previously saved post." xmlrpc (xmlrpc.php) en WordPress versión 2.1.2, y probablemente anteriores, permite a usuarios autenticados remotos con el rol de colaborador omitir las restricciones de acceso previstas e invocar la funcionalidad publish_posts, que puede ser usada pa... • http://secunia.com/advisories/24751 • CWE-264: Permissions, Privileges, and Access Controls CWE-285: Improper Authorization •
CVSS: 8.8EPSS: 2%CPEs: 3EXPL: 3CVE-2007-1897 – WordPress Core < 2.1.3 - SQL Injection
https://notcve.org/view.php?id=CVE-2007-1897
03 Apr 2007 — SQL injection vulnerability in xmlrpc (xmlrpc.php) in WordPress 2.1.2, and probably earlier, allows remote authenticated users to execute arbitrary SQL commands via a string parameter value in an XML RPC mt.setPostCategories method call, related to the post_id variable. Una vulnerabilidad de inyección SQL en xmlrpc (xmlrpc.php) en WordPress versión 2.1.2, y probablemente anteriores, permite a usuarios autenticados remotos ejecutar comandos SQL arbitrarios por medio de un valor del parámetro string en una ll... • https://www.exploit-db.com/exploits/3656 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 8.2EPSS: 6%CPEs: 1EXPL: 2CVE-2007-1244 – WordPress Core <= 2.1.1 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-1244
02 Mar 2007 — Cross-site request forgery (CSRF) vulnerability in the AdminPanel in WordPress 2.1.1 and earlier allows remote attackers to perform privileged actions as administrators, as demonstrated using the delete action in wp-admin/post.php. NOTE: this issue can be leveraged to perform cross-site scripting (XSS) attacks and steal cookies via the post parameter. Vulnerabilidad de falsificación de petición en sitios cruzados (CSRF) en el AdminPanel en WordPress 2.1.1 y anteriores permite a atacantes remotos realizar ac... • https://www.exploit-db.com/exploits/29682 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.2EPSS: 6%CPEs: 23EXPL: 2CVE-2007-1049 – WordPress Core < 2.09 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2007-1049
21 Feb 2007 — Cross-site scripting (XSS) vulnerability in the wp_explain_nonce function in the nonce AYS functionality (wp-includes/functions.php) for WordPress 2.0 before 2.0.9 and 2.1 before 2.1.1 allows remote attackers to inject arbitrary web script or HTML via the file parameter to wp-admin/templates.php, and possibly other vectors involving the action variable. Vulnerabilidad de secuencias de comandos en sitios cruzados (XSS) en la función wp_explain_nonce de la funcionalidad nonce AYS (wp-includes/functions.php) p... • https://www.exploit-db.com/exploits/29598 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 6.4EPSS: 0%CPEs: 1EXPL: 0CVE-2011-0700 – WordPress Core <= 3.0.4 - Cross-Site Scripting
https://notcve.org/view.php?id=CVE-2011-0700
11 Feb 2007 — Multiple cross-site scripting (XSS) vulnerabilities in WordPress before 3.0.5 allow remote authenticated users to inject arbitrary web script or HTML via vectors related to (1) the Quick/Bulk Edit title (aka post title or post_title), (2) post_status, (3) comment_status, (4) ping_status, and (5) escaping of tags within the tags meta box. Múltiples vulnerabilidades de ejecución de secuencias de comandos en sitios cruzados (XSS) en Wordpress en versiones anteriores a v3.0.5, permite a atacantes remotos inyect... • http://codex.wordpress.org/Version_3.0.5 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 7.5EPSS: 6%CPEs: 1EXPL: 1CVE-2007-0540 – WordPress Core 1.x/2.0.x - Pingback SourceURI Denial of Service / Information Disclosure
https://notcve.org/view.php?id=CVE-2007-0540
29 Jan 2007 — WordPress allows remote attackers to cause a denial of service (bandwidth or thread consumption) via pingback service calls with a source URI that corresponds to a file with a binary content type, which is downloaded even though it cannot contain usable pingback data. WordPress permite a atacantes remotos provocar una denegación de servicio (agotamiento de ancho de banda o hilos) mediante llamadas al servicio de pingback con un URI origen que corresponde a un archivo con un tipo de contenido binario, que es... • https://www.exploit-db.com/exploits/29522 •
CVSS: 6.5EPSS: 1%CPEs: 1EXPL: 0CVE-2007-0541 – WordPress Core < 2.1 - Directory Traversal
https://notcve.org/view.php?id=CVE-2007-0541
24 Jan 2007 — WordPress allows remote attackers to determine the existence of arbitrary files, and possibly read portions of certain files, via pingback service calls with a source URI that corresponds to a local pathname, which triggers different fault codes for existing and non-existing files, and in certain configurations causes a brief file excerpt to be published as a blog comment. WordPress permite a atacantes remotos determinar la existencia de archivos de su elección, y posiblemente leer porciones de determinados... • http://securityreason.com/securityalert/2191 • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CWE-264: Permissions, Privileges, and Access Controls •
CVSS: 5.3EPSS: 2%CPEs: 1EXPL: 1CVE-2008-0195 – WordPress Core < 2.1 - Full Path Disclosure
https://notcve.org/view.php?id=CVE-2008-0195
22 Jan 2007 — WordPress 2.0.11 and earlier allows remote attackers to obtain sensitive information via an empty value of the page parameter to certain PHP scripts under wp-admin/, which reveals the path in various error messages. WordPress 2.0.11 y anteriores permite a atacantes remotos obtener información sensible mediante un valor vacío del parámetro page a ciertas secuencias de comandos PHP bajo wp-admin/, lo cual revela la ruta en varios mensajes de error. • http://lists.grok.org.uk/pipermail/full-disclosure/2008-January/059439.html • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •