CVSS: 9.8EPSS: 0%CPEs: 1EXPL: 2CVE-2015-9452 – NEX-Forms – Ultimate Form Builder < 4.6.1 - SQL Injection
https://notcve.org/view.php?id=CVE-2015-9452
The nex-forms-express-wp-form-builder plugin before 4.6.1 for WordPress has SQL injection via the wp-admin/admin.php?page=nex-forms-main nex_forms_Id parameter. El plugin nex-forms-express-wp-form-builder versiones anteriores a 4.6.1 para WordPress, presenta una inyección SQL por medio del parámetro nex_forms_Id de wp-admin/admin.php?page=nex-forms-main. • http://cinu.pl/research/wp-plugins/mail_cb24b6204803e8e94943b198edc37af7.html https://wordpress.org/plugins/nex-forms-express-wp-form-builder/#developers https://wpvulndb.com/vulnerabilities/8336 • CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') •
CVSS: 7.5EPSS: 37%CPEs: 1EXPL: 23CVE-2006-3172 – Content-Builder (CMS) 0.7.5 - Multiple Include Vulnerabilities
https://notcve.org/view.php?id=CVE-2006-3172
Multiple PHP remote file inclusion vulnerabilities in Content*Builder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL with a trailing slash (/) character in the (1) lang_path parameter to (a) cms/plugins/col_man/column.inc.php, (b) cms/plugins/poll/poll.inc.php, (c) cms/plugins/user_managment/usrPortrait.inc.php, (d) cms/plugins/user_managment/user.inc.php, (e) cms/plugins/media_manager/media.inc.php, (f) cms/plugins/events/permanent.eventMonth.inc.php, (g) cms/plugins/events/events.inc.php, and (h) cms/plugins/newsletter2/newsletter.inc.php; (2) path[cb] parameter to (i) modules/guestbook/guestbook.inc.php, (j) modules/shoutbox/shoutBox.php, and (k) modules/sitemap/sitemap.inc.php; and the (3) rel parameter to (l) modules/download/overview.inc.php, (m) modules/download/detailView.inc.php, (n) modules/article/fullarticle.inc.php, (o) modules/article/comments.inc.php, (p) modules/article2/overview.inc.php, (q) modules/article2/fullarticle.inc.php, (r) modules/article2/comments.inc.php, (s) modules/headline/headlineBox.php, and (t) modules/headline/showHeadline.inc.php. Múltiples vulnerabilidades de inclusión remota de archivo PHP en Content*Builder 0.7.5 permiten a atacantes remotos ejecutar código PHP arbitrario a través de una URL con un carácter de barra inclinada (/) en el parámetro (1) lang_path para (a) cms/plugins/col_man/column.inc.php, (b) cms/plugins/poll/poll.inc.php, (c) cms/plugins/user_managment/usrPortrait.inc.php, (d) cms/plugins/user_managment/user.inc.php, (e) cms/plugins/media_manager/media.inc.php, (f) cms/plugins/events/permanent.eventMonth.inc.php, (g) cms/plugins/events/events.inc.php y (h) cms/plugins/newsletter2/newsletter.inc.php; parámetro (2) path[cb] para (i) modules/guestbook/guestbook.inc.php, (j) modules/shoutbox/shoutBox.php y (k) modules/sitemap/sitemap.inc.php; y el parámetro (3) rel para (l) modules/download/overview.inc.php, (m) modules/download/detailView.inc.php, (n) modules/article/fullarticle.inc.php, (o) modules/article/comments.inc.php, (p) modules/article2/overview.inc.php, (q) modules/article2/fullarticle.inc.php, (r) modules/article2/comments.inc.php, (s) modules/headline/headlineBox.php y (t) modules/headline/showHeadline.inc.php. • https://www.exploit-db.com/exploits/1903 http://marc.info/?l=bugtraq&m=115016951316696&w=2 http://secunia.com/advisories/20557 http://www.osvdb.org/26344 http://www.osvdb.org/26345 http://www.osvdb.org/26346 http://www.osvdb.org/26347 http://www.osvdb.org/26348 http://www.osvdb.org/26349 http://www.osvdb.org/26350 http://www.osvdb.org/26351 http://www.osvdb.org/26352 http://www.osvdb.org/26353 http://www.osvdb.org/26354 http:&#x • CWE-94: Improper Control of Generation of Code ('Code Injection') •
CVSS: 7.5EPSS: 6%CPEs: 1EXPL: 1CVE-2006-3173 – Content Builder 0.7.5 - 'postComment.php' Remote File Inclusion
https://notcve.org/view.php?id=CVE-2006-3173
Multiple PHP remote file inclusion vulnerabilities in Content*Builder 0.7.5 allow remote attackers to execute arbitrary PHP code via a URL in the (1) path[cb] parameter to (a) libraries/comment/postComment.php and (b) modules/poll/poll.php, (2) rel parameter to (c) modules/archive/overview.inc.php, and the (3) actualModuleDir parameter to (d) modules/forum/showThread.inc.php. NOTE: the provenance of this information is unknown; the details are obtained from third party information. • https://www.exploit-db.com/exploits/30634 http://secunia.com/advisories/20557 http://www.securityfocus.com/archive/1/481435/100/0/threaded http://www.securityfocus.com/bid/25914 https://exchange.xforce.ibmcloud.com/vulnerabilities/27044 •
CVSS: 7.5EPSS: 0%CPEs: 1EXPL: 1CVE-2006-1098 – NZ eCommerce System - 'index.php' Multiple SQL Injections
https://notcve.org/view.php?id=CVE-2006-1098
Multiple SQL injection vulnerabilities in NZ Ecommerce allow remote attackers to execute arbitrary SQL commands via the (1) informationID or (2) ParentCategory parameter to index.php. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem • https://www.exploit-db.com/exploits/27344 http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html http://secunia.com/advisories/19088 http://www.osvdb.org/23601 http://www.securityfocus.com/bid/16931 http://www.vupen.com/english/advisories/2006/0803 •
CVSS: 4.3EPSS: 1%CPEs: 1EXPL: 1CVE-2006-1096
https://notcve.org/view.php?id=CVE-2006-1096
Cross-site scripting (XSS) vulnerability in index.php in NZ Ecommerce allows remote attackers to inject arbitrary web script or HTML via the action parameter. NOTE: the vendor has disputed this issue in a comment on the researcher's blog, but research by CVE suggests that this might be a legitimate problem • http://pridels0.blogspot.com/2006/03/nz-ecommerce-sqlxss-vuln.html http://secunia.com/advisories/19088 http://www.osvdb.org/23600 http://www.securityfocus.com/bid/16931 http://www.vupen.com/english/advisories/2006/0803 •